PT-2004-3444 · Ignition · Ignitionserver

Keith Gable · Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2553

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The Ignition Project ignitionServer versions 0.1.2 through 0.1.2-R2

Description The issue allows remote authenticated users with local IRC operator privileges to obtain global IRC operator privileges. This is achieved by using the unofficial umode command with the +ORD argument.

Recommendations For versions 0.1.2 through 0.1.2-R2, consider restricting access to the umode command or removing the +ORD argument functionality to prevent exploitation until a patch is available.

Correção

Identificadores relacionados

CVE-2004-2553

Produtos afetados

Ignitionserver

Referências · 8

• http://securitytracker.com/id?1009301 · Correção
• http://sourceforge.net/tracker/index.php?func=detail&aid=891555&group_id=96071&atid=613526 · Nota
• http://cvs.sourceforge.net/viewcvs.py/ignition/ignitionserver/docs/security/20040302-operator-privilege-escalation.txt?view=markup · Nota
• http://securityfocus.com/bid/9783 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2004-2553 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15363 · Nota
• http://secunia.com/advisories/11017 · Correção
• http://osvdb.org/4121 · Nota