PT-2006-4022 · Hylafax · Capi4Hylafax

Lionel Elie Mamane · Publicado 2006-09-06 · Atualizado 2011-03-08 · CVE-2006-3126

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions capi4hylafax version 01.02.03

Description The issue allows remote attackers to execute arbitrary commands via null and shell metacharacters in the TSI string. This can be demonstrated by a fax from an anonymous number, which can include malicious input to exploit the weakness.

Recommendations For capi4hylafax version 01.02.03, consider restricting or validating input for the TSI string to prevent the inclusion of null and shell metacharacters, which can be used to execute arbitrary commands. As a temporary workaround, restrict access to the c2faxrecv function until a patch is available.

Correção

Identificadores relacionados

CVE-2006-3126

DSA-1165

Produtos afetados

Capi4Hylafax

Referências · 10

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=382474 · Correção
• http://secunia.com/advisories/22450 · Nota
• http://secunia.com/advisories/21722 · Aviso do Fabricante
• http://secunia.com/advisories/21726 · Aviso do Fabricante
• http://debian.org/security/2006/dsa-1165 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3126 · Nota de Segurança
• http://vupen.com/english/advisories/2006/3430 · Nota
• http://novell.com/linux/security/advisories/2007_4_sr.html · Aviso do Fabricante
• http://securityfocus.com/bid/19801 · Nota
• http://security.gentoo.org/glsa/glsa-200610-05.xml · Aviso do Fabricante