PT-2002-1514 · Really Simple Chat · Arsc

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0463

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ARSC (Really Simple Chat) versions 1.0.1 and earlier

Description The issue allows remote attackers to determine the full pathname of the web server. This is achieved by providing an invalid language in the arsc language parameter, which results in the pathname being leaked in an error message.

Recommendations For ARSC (Really Simple Chat) versions 1.0.1 and earlier, consider restricting access to the home.php file until a fix is available. As a temporary workaround, avoid using invalid languages in the arsc language parameter to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0463

Affected Products

Arsc

References · 5

• http://securityfocus.com/bid/4307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0463 · Security Note
• http://securityfocus.com/archive/1/262652 · Vendor Advisory
• http://securityfocus.com/archive/1/262802 · Vendor Advisory
• http://iss.net/security_center/static/8472.php · Note