PT-2008-5565 · Phpcollab · Phpcollab

Christian Hoffmann · Publicado 2008-12-23 · Atualizado 2017-08-08 · CVE-2008-4304

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: phpCollab versions 2.5 rc3 and earlier

Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL CLIENT CERT environment variable. In some environments, SSL CLIENT CERT always has a base64-encoded string value, which may impose constraints on injection for typical shells.

Recommendations: For phpCollab versions 2.5 rc3 and earlier, consider restricting access to the general/login.php file until a fix is available. As a temporary workaround, avoid using the SSL CLIENT CERT environment variable in sensitive operations.

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2008-4304

Produtos afetados

Phpcollab

Referências · 7

• http://securityfocus.com/bid/32964 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47522 · Nota
• http://security.gentoo.org/glsa/glsa-200812-20.xml · Aviso do Fabricante
• http://secunia.com/advisories/33258 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4304 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4304 · Nota de Segurança
• http://bugs.gentoo.org/show_bug.cgi?id=235052 · Nota