PT-2007-3839 · Php+1 · Pear+1

Gregory Beaver · Publicado 2007-05-22 · Atualizado 2017-07-29 · CVE-2007-2519

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PEAR versions 1.0 through 1.5.3

Description The issue allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the install-as attribute in the file element in package.xml 1.0 or the as attribute in the install element in package.xml 2.0.

Recommendations For PEAR versions 1.0 through 1.5.3, consider restricting the use of the install-as attribute in package.xml 1.0 and the as attribute in package.xml 2.0 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-2519

Produtos afetados

Pear

Suse

Referências · 11

• 🔥 https://exploit-db.com/exploits/30074 · Exploit
• 🔥 http://pear.php.net/advisory-20070507.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34482 · Nota
• http://pear.php.net/news/vulnerability2.php · Nota
• http://vupen.com/english/advisories/2007/1926 · Nota
• http://secunia.com/advisories/25372 · Nota
• http://osvdb.org/42108 · Nota
• http://ubuntu.com/usn/usn-462-1 · Aviso do Fabricante
• http://securityfocus.com/bid/24111 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2007:110 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2519 · Nota de Segurança