PT-2006-6943 · Torrentflux · Torrentflux

Stefan Fritsch · Publicado 2006-12-06 · Atualizado 2008-09-05 · CVE-2006-6331

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TorrentFlux version 2.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the torrent parameter to API endpoints such as "details.php" and "startpop.php", when the $cfg["enable file priority"] is set to false.

Recommendations For TorrentFlux version 2.2, consider setting $cfg["enable file priority"] to true as a temporary workaround to mitigate the risk of exploitation. Restrict access to the "details.php" and "startpop.php" API endpoints to minimize the risk of exploitation. Avoid using shell metacharacters in the torrent parameter until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-6331

Produtos afetados

Torrentflux

Referências · 5

• http://secunia.com/advisories/23270 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi/11_missed_security_fixes.dpatch?bug=400582%3Bmsg=71%3Batt=1 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6331 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6331 · Nota de Segurança