PT-2008-2279 · Emc · Emc Documentum Administrator+1

Pablo Gaston Milano · Publicado 2008-02-07 · Atualizado 2018-10-15 · CVE-2008-0656

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum Administrator version 5.3.0.313 EMC Documentum Webtop version 5.3.0.317

Description The issue allows remote attackers to overwrite arbitrary files via the filename attribute in the dmclTrace.jsp file. This can be exploited by uploading files with malicious intent.

Recommendations For EMC Documentum Administrator version 5.3.0.313, restrict access to the dmclTrace.jsp file to prevent unauthorized file uploads. For EMC Documentum Webtop version 5.3.0.317, restrict access to the dmclTrace.jsp file to prevent unauthorized file uploads. As a temporary workaround, consider disabling the file upload functionality in the dmclTrace.jsp file until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-0656

Produtos afetados

Emc Documentum Administrator

Emc Documentum Webtop

Referências · 9

• http://securityfocus.com/archive/1/487603/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0656 · Nota
• http://vupen.com/english/advisories/2008/0439 · Nota
• http://secunia.com/advisories/28810 · Aviso do Fabricante
• http://securityfocus.com/bid/27632 · Nota
• http://securityreason.com/securityalert/3626 · Nota
• http://cybsec.com/vuln/CYBSEC-Security_Advisory_Documentum_dmclTrace_Arbitrary_file_overwrite.pdf · Nota
• http://securitytracker.com/id?1019305 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0656 · Nota de Segurança