PT-2006-6690 · Webshare · Oliver

Publicado 2006-11-22 · Atualizado 2017-07-20 · CVE-2006-6043

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oliver (formerly Webshare) versions 1.2.2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a UNC share pathname or a local file pathname in the conf[motdfile] parameter, which is accessed by the file exists function.

Recommendations For Oliver (formerly Webshare) versions 1.2.2 and earlier, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the conf[motdfile] parameter to minimize the risk of arbitrary PHP code execution. Avoid using the conf[motdfile] parameter with untrusted input until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-6043

Produtos afetados

Oliver

Referências · 5

• http://securityfocus.com/bid/21202/info · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6043 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4608 · Nota
• http://secunia.com/advisories/23031 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30415 · Nota