PT-2008-2544 · Sword · The Sword Project Diatheke

Lubomir Kundrak · Publicado 2008-02-25 · Atualizado 2011-03-08 · CVE-2008-0932

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The SWORD Project Diatheke versions 1.5.9 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter. This can lead to unauthorized access and control of the system.

Recommendations For versions 1.5.9 and earlier, consider restricting access to the diatheke.pl script until a patch is available, and avoid using the range parameter with untrusted input.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-0932

DSA-1508-1

Produtos afetados

The Sword Project Diatheke

Referências · 17

• http://vupen.com/english/advisories/2008/0670/references · Nota
• http://secunia.com/advisories/29115 · Aviso do Fabricante
• http://secunia.com/advisories/25400 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00806.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00769.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0932 · Aviso do Fabricante
• http://secunia.com/advisories/29012 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1508 · Aviso do Fabricante
• http://securityfocus.com/bid/27987 · Nota
• http://security.gentoo.org/glsa/glsa-200803-06.xml · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-0932 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0932 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2008-0932 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=433723 · Nota
• http://securityfocus.com/bid/27874 · Nota