PT-2009-6207 · Pear · Net Ping

Saltybeagle · Publicado 2009-11-28 · Atualizado 2017-08-17 · CVE-2009-4024

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Net Ping package versions prior to 2.4.5 for PEAR

Description The issue is related to an argument injection vulnerability in the ping function in Ping.php. This allows remote attackers to execute arbitrary shell commands via the host parameter. It has also been reported as a shell metacharacter problem.

Recommendations For versions prior to 2.4.5, update to version 2.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the ping function in Ping.php to minimize the risk of exploitation. Avoid using the host parameter in the affected function until the issue is resolved.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-4024

DSA-1949-1

Produtos afetados

Net Ping

Referências · 15

• http://pear.php.net/advisory20091114-01.txt · Aviso do Fabricante
• http://svn.php.net/viewvc/pear/packages/Net_Ping/trunk/Ping.php?r1=274728&r2=290669&pathrev=290669 · Nota
• http://vupen.com/english/advisories/2009/3320 · Aviso do Fabricante
• http://securityfocus.com/bid/37093 · Nota
• http://pear.php.net/package/Net_Ping/download/2.4.5 · Aviso do Fabricante
• http://debian.org/security/2009/dsa-1949 · Aviso do Fabricante
• http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory · Correção
• http://secunia.com/advisories/37451 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4024 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-November/msg01152.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4024 · Nota de Segurança
• http://secunia.com/advisories/37502 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54390 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-November/msg01130.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-November/msg01044.html · Aviso do Fabricante