PT-2006-3367 · Unclassified · Unclassified Newsboard

Rgod · Publicado 2006-05-16 · Atualizado 2008-09-05 · CVE-2006-2406

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Unclassified NewsBoard (UNB) versions 1.5.3-d and earlier

Description The issue allows remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing null byte (%00) in the design path parameter when register globals is enabled. This is related to, but distinct from, the ABBC[Config][smileset] parameter issue.

Recommendations For Unclassified NewsBoard (UNB) versions 1.5.3-d and earlier, consider disabling the register globals setting to mitigate the risk of exploitation. Restrict access to the design path parameter to minimize the risk of including arbitrary files. Avoid using the design path parameter with .. (dot dot) sequences and a trailing null byte (%00) until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-2406

Produtos afetados

Unclassified Newsboard

Referências · 5

• 🔥 https://exploit-db.com/exploits/1777 · Exploit
• http://osvdb.org/25494 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2406 · Nota de Segurança
• http://newsboard.unclassified.de/forum/post/6499 · Correção
• http://attrition.org/pipermail/vim/2006-May/000769.html · Nota