PT-2002-2408 · Badblue+2 · Badblue Personal Edition+3

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Deerfield D2Gfx version 1.0.2 BadBlue Enterprise Edition versions 1.5.x BadBlue Personal Edition version 1.5.6

Description A directory traversal issue allows remote attackers to read arbitrary files by using a ../ (dot dot slash) in the script used to read Microsoft Office documents.

Recommendations For Deerfield D2Gfx version 1.0.2, update the script used to read Microsoft Office documents to properly handle ../ (dot dot slash) sequences. For BadBlue Enterprise Edition versions 1.5.x, restrict access to the script used to read Microsoft Office documents until a proper fix is applied. For BadBlue Personal Edition version 1.5.6, consider disabling the functionality to read Microsoft Office documents via the vulnerable script until an update is available.

Fix

Related Identifiers

CVE-2002-1684

Affected Products

Badblue Enterprise Edition

Badblue Personal Edition

Deerfield D2Gfx

Office

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1684 · Security Note
• http://securityfocus.com/bid/3913 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1684 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7946 · Note
• http://securityfocus.com/archive/1/251523 · Note