PT-2009-4788 · Tekradius · Tekradius

Tim Brown · Publicado 2009-07-07 · Atualizado 2018-10-10 · CVE-2009-2359

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TekRADIUS version 3.0

Description The issue allows context-dependent attackers to execute arbitrary SQL commands. This can be achieved via the GUI client, for example, by input to the Browse Users text box in the Users tab, or via the command-line client using a certain trcli -r command.

Recommendations For TekRADIUS version 3.0, consider restricting access to the GUI client and command-line client until a patch is available. As a temporary workaround, avoid using the Browse Users text box in the Users tab and refrain from using the trcli -r command.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2359

Produtos afetados

Tekradius

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-2359 · Nota de Segurança
• http://vupen.com/english/advisories/2009/1816 · Nota
• http://nth-dimension.org.uk/utils/get.php?downloadsid=56 · Nota
• http://securityfocus.com/archive/1/504740/100/0/threaded · Nota