PT-2006-3427 · Bitrix+1 · Bitrix Site Manager+1

Gogi The Georgian · Publicado 2006-05-19 · Atualizado 2018-10-18 · CVE-2006-2479

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bitrix Site Manager versions 4.1.x

Description The issue concerns the Update functionality, which fails to verify the authenticity of downloaded updates. This allows remote attackers to obtain sensitive information and execute arbitrary PHP code via DNS cache poisoning, redirecting the user to a malicious site.

Recommendations For Bitrix Site Manager versions 4.1.x, consider implementing authentication checks for downloaded updates to prevent DNS cache poisoning attacks. As a temporary workaround, restrict access to the update functionality until a proper fix is applied.

Exploit

Correção

Identificadores relacionados

CVE-2006-2479

Produtos afetados

Bitrix

Bitrix Site Manager

Referências · 8

• 🔥 http://securitytracker.com/id?1016121 · Exploit
• http://securityreason.com/securityalert/918 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2479 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2479 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26542 · Nota
• http://vupen.com/english/advisories/2006/1858 · Nota
• http://securityfocus.com/archive/1/434367/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26548 · Nota