PT-2015-4921 · Debian+1 · Smokeping+1

Tero Marttila · Publicado 2015-11-25 · Atualizado 2015-12-04 · CVE-2015-0859

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions smokeping versions prior to 2.6.8-2+deb7u1 in wheezy smokeping versions prior to 2.6.9-1+deb8u1 in jessie

Description The issue arises from the Debian build procedure for the smokeping package, which does not properly configure how Apache httpd passes arguments to smokeping cgi. This allows remote attackers to execute arbitrary code via crafted CGI arguments.

Recommendations For smokeping versions prior to 2.6.8-2+deb7u1 in wheezy, update to version 2.6.8-2+deb7u1 or later. For smokeping versions prior to 2.6.9-1+deb8u1 in jessie, update to version 2.6.9-1+deb8u1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2015-0859

DSA-3405-1

Produtos afetados

Apache Httpd

Smokeping

Referências · 13

• https://cve.org/CVERecord?id=CVE-2015-0859 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3405-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3405-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0859 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0859 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-0859 · Nota de Segurança
• http://debian.org/security/2015/dsa-3405 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-0859 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-0859 · Aviso do Fabricante
• https://packages.debian.org/src:smokeping · Nota
• https://security-tracker.debian.org/tracker/source-package/smokeping · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-0859 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-0859 · Aviso do Fabricante