PT-2006-2849 · Beagle · Beagle

Chris Evans + 1 · Published 2006-04-21 · Updated 2024-02-13 · CVE-2006-1865

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Beagle versions prior to 0.2.5

Description The issue allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing. This is due to an argument injection vulnerability.

Recommendations For versions prior to 0.2.5, update to version 0.2.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of external helper applications or validating filenames to prevent argument injection until a patch is available.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2006-1865

Affected Products

Beagle

References · 14

• http://secunia.com/advisories/19778 · Vendor Advisory
• http://secunia.com/advisories/19781 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-1865 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-1865 · Vendor Advisory
• http://secunia.com/advisories/19897 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_04_28.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1865 · Security Note
• http://lists.seifried.org/pipermail/security/2006-April/013163.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1865 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26104 · Note
• http://osvdb.org/24938 · Note
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189282 · Note
• http://securityfocus.com/bid/17611 · Note
• http://scary.beasts.org/security/CESA-2006-002.html · Note