PT-2005-3387 · Rapid7 · Metasploit Framework

Publicado 2005-08-07 · Atualizado 2017-07-11 · CVE-2005-2482

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Metasploit Framework versions 2.4 and earlier

Description The issue concerns the StateToOptions function in msfweb, which is part of the Metasploit Framework. When running in defanged mode (with the -D option), this function allows attackers to modify temporary environment variables before the " Defanged" environment option is checked. This occurs during the processing of the Exploit command.

Recommendations For Metasploit Framework versions 2.4 and earlier, consider disabling the StateToOptions function or defanged mode until a fix is available to prevent potential exploitation. Restrict access to the Exploit command to minimize the risk of modification of temporary environment variables.

Correção

Identificadores relacionados

CVE-2005-2482

Produtos afetados

Metasploit Framework

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/21705 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2482 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2482 · Nota de Segurança
• http://secunia.com/advisories/16318 · Aviso do Fabricante
• http://securityfocus.com/bid/14455 · Nota
• http://metasploit.com/archive/framework/msg00469.html · Nota
• http://osvdb.org/18495 · Nota