PT-2006-5652 · Microsoft+1 · Windows+1

Publicado 2006-09-22 · Atualizado 2021-04-09 · CVE-2006-4899

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CA eTrust Security Command Center versions 1.0 and r8 up to SP1 CR2

Description The issue allows remote attackers to obtain the web server path via a single quote in the PIProfile function, which leaks the path in an error message. This occurs when the ePPIServlet script is running on Windows.

Recommendations For CA eTrust Security Command Center versions 1.0 and r8 up to SP1 CR2, consider restricting access to the ePPIServlet script until a fix is available. As a temporary workaround, avoid using the PIProfile function with untrusted input to minimize the risk of path leakage.

Exploit

Correção

Identificadores relacionados

CVE-2006-4899

Produtos afetados

Ca Etrust Security Command Center

Windows

Referências · 13

• 🔥 http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt · Exploit
• 🔥 http://secunia.com/advisories/22023 · Exploit
• 🔥 https://exploit-db.com/exploits/28640 · Exploit
• http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9 · Nota
• http://securityfocus.com/bid/20139 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4899 · Nota de Segurança
• http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34616 · Nota
• http://osvdb.org/29009 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29102 · Nota
• http://vupen.com/english/advisories/2006/3738 · Nota
• http://securityfocus.com/archive/1/446611/100/0/threaded · Nota
• http://securitytracker.com/id?1016910 · Nota
• http://securityfocus.com/archive/1/446716/100/0/threaded · Nota