PT-2010-3268 · Phpthumb+1 · Phpthumb+1

Publicado 2010-04-29 · Atualizado 2017-08-17 · CVE-2010-1598

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpThumb() version 1.7.9

Description The issue allows remote attackers to execute arbitrary commands when ImageMagick is installed. This is achieved via the fltr[] parameter. The problem was discovered in the wild in April 2010.

Recommendations For phpThumb() version 1.7.9, consider restricting access to the fltr[] parameter until a patch is available. As a temporary workaround, disabling the use of ImageMagick with phpThumb() may minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-1598

Produtos afetados

Imagemagick

Phpthumb

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-1598 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58040 · Nota
• http://secunia.com/advisories/57038 · Nota
• http://securityfocus.com/bid/39605 · Nota
• http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss · Nota
• http://osvdb.org/63939 · Nota
• http://secunia.com/advisories/39556 · Aviso do Fabricante