PT-2002-1513 · Big Sam · Big Sam

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0462

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Big Sam (Built-In Guestbook Stand-Alone Module) versions 1.1.08 and earlier

Description The issue allows remote attackers to cause a denial of service or obtain the absolute path of the web server. This can be achieved by providing a very large number in the displayBegin parameter. When PHP safe mode is enabled, the web path is leaked in an error message. When safe mode is not enabled, the action consumes resources.

Recommendations For Big Sam (Built-In Guestbook Stand-Alone Module) versions 1.1.08 and earlier, consider restricting access to the bigsam guestbook.php file until a patch is available. As a temporary workaround, avoid using the displayBegin parameter with large numbers to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-0462

Affected Products

Big Sam

References · 8

• 🔥 http://securityfocus.com/bid/4312 · Exploit
• http://iss.net/security_center/static/8478.php · Vendor Advisory
• http://securityfocus.com/archive/1/262735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0462 · Security Note
• http://iss.net/security_center/static/8479.php · Vendor Advisory
• http://osvdb.org/5287 · Note
• http://osvdb.org/5288 · Note
• http://gezzed.net/bigsam/bigsam.1_1_12.php.txt · Note