PT-2006-6694 · Apache+1 · Apache Http Server+1

Alfredo Pesoli + 1 · Publicado 2006-11-22 · Atualizado 2018-10-17 · CVE-2006-6047

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Etomite version 0.6.1.2

Description The issue allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter. This can be demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.

Recommendations For Etomite version 0.6.1.2, consider restricting access to the f parameter in the manager/index.php file to prevent directory traversal attacks. As a temporary workaround, restrict the ability of administrators to include local files using the .. (dot dot) sequence in the f parameter until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2006-6047

Produtos afetados

Apache Http Server

Etomite

Referências · 10

• 🔥 https://exploit-db.com/exploits/2790 · Exploit
• 🔥 http://0xcafebabe.it/sploits/etm_0612_remote_com.pl · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6047 · Nota de Segurança
• http://secunia.com/advisories/22885 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/4558 · Aviso do Fabricante
• http://securityfocus.com/bid/21135 · Nota
• http://securityfocus.com/archive/1/451838/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30329 · Nota
• http://etomite.org/forums/index.php?showtopic=6388 · Nota
• http://securityfocus.com/archive/1/451930/100/0/threaded · Nota