PT-2006-5653 · Ca · Ca Etrust Security Command Center

Publicado 2006-09-22 · Atualizado 2021-04-09 · CVE-2006-4900

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA eTrust Security Command Center versions 1.0 and r8 up to SP1 CR2

Description A directory traversal issue allows remote authenticated users to read and delete arbitrary files by using ".." sequences in the eSCCAdHocHtmlFile parameter to the "eSMPAuditServlet" endpoint. This is due to improper handling by the getadhochtml function.

Recommendations For CA eTrust Security Command Center versions 1.0 and r8 up to SP1 CR2, consider restricting access to the eSMPAuditServlet endpoint until a proper fix is available. As a temporary workaround, avoid using the eSCCAdHocHtmlFile parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-4900

Produtos afetados

Ca Etrust Security Command Center

Referências · 13

• 🔥 https://exploit-db.com/exploits/28641 · Exploit
• 🔥 http://osvdb.org/29010 · Exploit
• 🔥 http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt · Exploit
• 🔥 http://secunia.com/advisories/22023 · Exploit
• 🔥 http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9 · Exploit
• http://securityfocus.com/bid/20139 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4900 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29104 · Nota
• http://vupen.com/english/advisories/2006/3738 · Nota
• http://securityfocus.com/archive/1/446611/100/0/threaded · Nota
• http://securitytracker.com/id?1016910 · Nota
• http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34617 · Aviso do Fabricante
• http://securityfocus.com/archive/1/446716/100/0/threaded · Nota