PT-2006-6633 · Verity · Verity Ultraseek

Sullo · Publicado 2006-11-18 · Atualizado 2018-10-17 · CVE-2006-5971

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Verity Ultraseek versions prior to 5.6.2

Description The issue allows remote attackers to read arbitrary files due to an absolute path traversal vulnerability in the admin/logfile.txt file. This is achieved by exploiting the name variable.

Recommendations For versions prior to 5.6.2, update to version 5.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/logfile.txt file to minimize the risk of exploitation. Avoid using the name variable in the affected file until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-5971

Produtos afetados

Verity Ultraseek

Referências · 9

• http://zerodayinitiative.com/advisories/ZDI-06-042.html · Nota
• http://ultraseek.com/support/docs/release_notes/ultraseek.5.6.2.txt · Nota
• http://osvdb.org/30289 · Nota
• http://ultraseek.com/support/docs/RELNOTES.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5971 · Nota de Segurança
• http://secunia.com/advisories/22892 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5971 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30321 · Nota
• http://securityfocus.com/archive/1/451847/100/0/threaded · Nota