PT-2005-4217 · Hyper Estraier · Hyper Estraier

Publicado 2005-11-01 · Atualizado 2008-11-11 · CVE-2005-3421

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hyper Estraier version 1.0.1

Description The issue allows remote attackers to read unauthorized files by sending a crafted search request for a filename that contains Unicode characters. This is made possible through the estcmd in Hyper Estraier on Windows systems.

Recommendations For Hyper Estraier version 1.0.1, consider restricting access to the estcmd until a patch is available to prevent unauthorized file reading. As a temporary workaround, avoid using filenames that contain Unicode characters in search requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-3421

Produtos afetados

Hyper Estraier

Referências · 6

• http://sourceforge.net/project/shownotes.php?release_id=366565 · Correção
• http://securityfocus.com/bid/15236 · Correção
• http://securitytracker.com/id?1015119 · Correção
• http://secunia.com/advisories/17379 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3421 · Nota de Segurança
• http://jvn.jp/jp/JVN%2318282718/index.html · Nota