PT-2006-7118 · Winamp · Winamp Web Interface

Luigi Auriemma · Publicado 2006-12-14 · Atualizado 2018-10-17 · CVE-2006-6514

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Winamp Web Interface (Wawi) versions 7.5.13 and earlier

Description The issue allows remote authenticated users to access certain other directories if the name of the root directory is a substring of the name of the target directory. This is due to an insufficient comparison used to determine whether a directory is located below the application's root directory. For example, accessing C:folder2 when the root directory is C:folder is possible.

Recommendations For versions 7.5.13 and earlier, update to a version that addresses this issue, as the current version allows unauthorized directory access due to the insufficient comparison.

Correção

Identificadores relacionados

CVE-2006-6514

Produtos afetados

Winamp Web Interface

Referências · 11

• http://securitytracker.com/id?1017362 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6514 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6514 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.html · Nota
• http://securityreason.com/securityalert/2032 · Nota
• http://secunia.com/advisories/23292 · Aviso do Fabricante
• http://aluigi.altervista.org/adv/wawix-adv.txt · Nota
• http://securityfocus.com/bid/21539 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30830 · Nota
• http://securityfocus.com/archive/1/454059/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/4935 · Nota