PT-2004-3410 · Gattaca · Gattaca Server 2003

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2518

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gattaca Server 2003 version 1.1.10.0

Description The issue allows remote attackers to obtain sensitive information. This can be achieved by either appending a trailing null byte ("%00") to a URL or by providing an invalid LANGUAGE parameter to web.tmpl, which results in an error message that reveals the full installation path.

Recommendations For Gattaca Server 2003 version 1.1.10.0, consider restricting access to the web.tmpl endpoint until a fix is available. As a temporary workaround, avoid using invalid LANGUAGE parameters to prevent the disclosure of sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-2518

Affected Products

Gattaca Server 2003

References · 12

• 🔥 http://secunia.com/advisories/12071 · Exploit
• 🔥 https://exploit-db.com/exploits/24284 · Exploit
• 🔥 https://exploit-db.com/exploits/24285 · Exploit
• 🔥 http://osvdb.org/7923 · Exploit
• 🔥 http://securityfocus.com/bid/10729 · Exploit
• 🔥 http://securitytracker.com/id?1010703 · Exploit
• 🔥 http://osvdb.org/7922 · Exploit
• http://members.lycos.co.uk/r34ct/main/Gattaca%20Server%202003.txt · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2518 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16699 · Note
• http://gattaca-server.com/cgi-bin/yabb/YaBB.pl?board=gattaca_discussion%3Baction=display%3Bnum=1091194176%3Bstart=0#0 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16700 · Note