PT-2007-5016 · Unknown · G/Pgp Plugin

George A. Theall · Publicado 2007-07-15 · Atualizado 2017-07-29 · CVE-2007-3778

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions G/PGP Plugin versions 2.0 through 2.1dev before 20060912

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpg check sign pgp mime function in gpg hook functions.php. A parameter value can be set in the contents of an e-mail message.

Recommendations For G/PGP Plugin versions 2.0 through 2.1dev before 20060912, consider restricting access to the gpg check sign pgp mime function in gpg hook functions.php to minimize the risk of exploitation. Avoid using the messageSignedText parameter in the affected function until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3778

Produtos afetados

G/Pgp Plugin

Referências · 11

• http://securityfocus.com/bid/24874 · Nota
• http://lists.immunitysec.com/pipermail/dailydave/2007-July/004456.html · Nota
• http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html · Nota
• http://secunia.com/advisories/26035 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3778 · Nota de Segurança
• http://attrition.org/pipermail/vim/2007-July/001704.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35363 · Nota
• http://osvdb.org/37931 · Nota
• http://attrition.org/pipermail/vim/2007-July/001710.html · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330 · Correção
• http://vupen.com/english/advisories/2007/2513 · Nota