PT-2003-1269 · Unknown · Molly Irc Bot

Publicado 2003-03-18 · Atualizado 2008-09-05 · CVE-2002-1536

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Molly IRC bot version 0.5

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in several variables across different scripts, including the $host variable in nslookup.pl, the $to, $from, or $message variables in pop.pl, the $words or $text variables in sms.pl, and the $server or $printer variables in hpled.pl.

Recommendations For Molly IRC bot version 0.5, consider restricting or sanitizing input for the $host variable in nslookup.pl, the $to, $from, and $message variables in pop.pl, the $words and $text variables in sms.pl, and the $server and $printer variables in hpled.pl to prevent command execution. As a temporary workaround, consider disabling the execution of shell commands from these scripts until a patch is available.

Correção

Identificadores relacionados

CVE-2002-1536

Produtos afetados

Molly Irc Bot

Referências · 5

• http://securityfocus.com/bid/6007 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0028.html · Nota
• http://online.securityfocus.com/archive/1/296163 · Aviso do Fabricante
• http://iss.net/security_center/static/10397.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1536 · Nota de Segurança