PT-2001-2125 · Orbis Gmbh · Bscw

Published 2001-08-31 · Updated 2008-09-05 · CVE-2001-0973

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BSCW groupware system versions 3.3 through 4.0.2 beta

Description The issue allows remote attackers to read or modify arbitrary files. This is achieved by uploading and extracting a tar file with a symlink into the data-bag space.

Recommendations For versions 3.3 through 4.0.2 beta, consider restricting access to the file upload feature to prevent exploitation until a fix is available. As a temporary workaround, avoid using the data-bag space for sensitive files.

Fix

Related Identifiers

CVE-2001-0973

Affected Products

Bscw

References · 6

• http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0973 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2001-08/0328.html · Vendor Advisory
• http://kb.cert.org/vuls/id/465971 · Note
• http://securityfocus.com/bid/3227 · Note
• http://iss.net/security_center/static/7029.php · Note