PT-2005-3509 · Autonomy+1 · Autonomy Keyview Sdk+1

Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-2619

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autonomy KeyView SDK versions prior to 9.2.0 Lotus Notes versions 6.5.4 and 7.0

Description The issue allows remote attackers to delete arbitrary files by exploiting a directory traversal vulnerability. This can be achieved through a ZIP, UUE, or TAR archive containing a .. (dot dot) in the filename, which is not properly handled when generating a preview.

Recommendations For Autonomy KeyView SDK versions prior to 9.2.0, update to version 9.2.0 or later. For Lotus Notes versions 6.5.4 and 7.0, consider restricting access to the KeyView SDK functionality until a patch or update is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2005-2619

Affected Products

Autonomy Keyview Sdk

Lotus Notes

References · 13

• http://secunia.com/advisories/16280 · Vendor Advisory
• http://secunia.com/advisories/16100 · Vendor Advisory
• http://osvdb.org/23066 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-2619 · Security Note
• http://secunia.com/secunia_research/2005-30/advisory · Vendor Advisory
• http://securitytracker.com/id?1015657 · Patch
• http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229918 · Patch
• http://secunia.com/secunia_research/2005-66/advisory · Vendor Advisory
• http://securityfocus.com/bid/16576 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2619 · Note
• http://securityfocus.com/archive/1/424717/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24637 · Note
• http://vupen.com/english/advisories/2006/0500 · Note