PT-2008-6757 · Verlihub · Verlihub

V4Lkyrius · Publicado 2008-12-22 · Atualizado 2017-09-29 · CVE-2008-5705

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Verlihub versions 0.9.8d-RC2 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an argument when user triggers are enabled. This is due to a problem in the cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon.

Recommendations For Verlihub versions 0.9.8d-RC2 and earlier, consider disabling the cTrigger::DoIt function or user triggers until a patch is available to prevent the execution of arbitrary commands. Restrict access to the trigger mechanism to minimize the risk of exploitation. Avoid using arguments that contain shell metacharacters in the affected function.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-5705

Produtos afetados

Verlihub

Referências · 7

• 🔥 https://exploit-db.com/exploits/7183 · Exploit
• http://bugs.debian.org/506530 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46801 · Nota
• http://securityreason.com/securityalert/4800 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5705 · Nota de Segurança
• http://securityfocus.com/bid/32420 · Nota
• http://openwall.com/lists/oss-security/2008/12/17/16 · Nota