PT-2006-1915 · Php Extension Application Repository · Pear Liveuser

James Bercegay · Publicado 2006-02-23 · Atualizado 2018-10-18 · CVE-2006-0869

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP Extension and Application Repository (PEAR) LiveUser versions 0.16.8 and earlier

Description A directory traversal issue exists in the "remember me" feature of liveuser.php, allowing remote attackers to determine file existence. Attackers may also be able to delete arbitrary files with short pathnames or read arbitrary files by using a .. (dot dot) in the store id value of a cookie.

Recommendations For PHP Extension and Application Repository (PEAR) LiveUser versions 0.16.8 and earlier, consider disabling the "remember me" feature in liveuser.php until a patch is available. Restrict access to the store id value of a cookie to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-0869

Produtos afetados

Pear Liveuser

Referências · 11

• 🔥 https://exploit-db.com/exploits/43834 · Exploit
• http://pear.php.net/package/LiveUser/download · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24853 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24852 · Nota
• http://gulftech.org/?node=research&article_id=00103-02212006 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0869 · Nota de Segurança
• http://securitytracker.com/id?1015659 · Correção
• http://securityfocus.com/archive/1/425711/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/0697 · Nota
• http://securityfocus.com/bid/16761 · Nota
• http://securityreason.com/securityalert/466 · Nota