PT-2002-2559 · Unknown · Image Display System

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1837

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Image Display System (IDS) version 0.81

Description The issue allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter. This is due to the getAlbumToDisplay function in idsShared.pm generating different error messages depending on whether the directory exists or not.

Recommendations For version 0.81, consider restricting access to the getAlbumToDisplay function until a patch is available. As a temporary workaround, avoid using the album parameter with ".." sequences in the affected API endpoint.

Exploit

Fix

Related Identifiers

CVE-2002-1837

Affected Products

Image Display System

References · 6

• 🔥 http://securityfocus.com/bid/4870 · Exploit
• 🔥 https://exploit-db.com/exploits/21487 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1837 · Security Note
• http://iss.net/security_center/static/9201.php · Note
• http://online.securityfocus.com/archive/1/274433 · Note
• http://ids.sourceforge.net/ChangeLog.html · Note