PT-2005-1347 · Gnu · Gnuboard

Published 2005-02-10 · Updated 2024-02-02 · CVE-2005-0269

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNUBoard versions 3.40 and earlier

Description The issue allows remote attackers to upload arbitrary files by exploiting a weakness in the file extension check, which only verifies extensions containing all lowercase letters. This enables attackers to upload files with extensions that include uppercase letters.

Recommendations For GNUBoard versions 3.40 and earlier, consider implementing a case-insensitive file extension check to prevent the upload of arbitrary files. As a temporary workaround, restrict file uploads to only those with extensions containing all lowercase letters until a proper fix is applied.

Exploit

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2005-0269

Affected Products

Gnuboard

References · 7

• 🔥 http://marc.info/?l=bugtraq&m=110477648219738&w=2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0269 · Security Note
• https://t.me/cvenotify/69678 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18729 · Note
• http://secunia.com/advisories/13711 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0269 · Note
• http://securityfocus.com/bid/12149 · Note