PT-2007-1166 · Unknown · G/Pgp Plugin

Publicado 2007-07-15 · Atualizado 2017-07-20 · CVE-2006-4169

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: G/PGP (GPG) Plugin versions 2.0 through 2.1dev before 20070614

Description: The issue allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the help parameter to API endpoints such as "gpg help.php" or "gpg help base.php".

Recommendations: For G/PGP (GPG) Plugin versions 2.0 through 2.1dev before 20070614, consider updating to a version released after 20070614 to resolve the issue. As a temporary workaround, restrict access to the "gpg help.php" and "gpg help base.php" files to minimize the risk of exploitation. Avoid using the help parameter in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-4169

Produtos afetados

G/Pgp Plugin

Referências · 10

• http://secunia.com/advisories/26424 · Nota
• http://osvdb.org/37932 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35362 · Nota
• http://osvdb.org/37933 · Nota
• http://secunia.com/advisories/26035 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/2513 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=555 · Nota
• http://securityfocus.com/bid/24874 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4169 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200708-08.xml · Aviso do Fabricante