PT-2006-2937 · Caucho · Caucho Resin

Published 2006-05-17 · Updated 2018-10-18 · CVE-2006-1953

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Caucho Resin versions 3.0.17 through 3.0.18

Description A directory traversal issue allows remote attackers to read arbitrary files. This is achieved by using a "C:%5C" (encoded drive letter) in a URL.

Recommendations For versions 3.0.17 and 3.0.18, consider restricting access to sensitive files and directories until a patch is available. As a temporary workaround, avoid using encoded drive letters in URLs to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1953

Affected Products

Caucho Resin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2006-1953 · Security Note
• http://securityfocus.com/bid/18005 · Patch
• http://securityreason.com/securityalert/904 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1953 · Note
• http://rapid7.com/advisories/R7-0024.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26478 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0026.html · Note
• http://securityfocus.com/archive/1/434150/100/0/threaded · Note
• http://secunia.com/advisories/20125 · Note
• http://osvdb.org/25570 · Note
• http://vupen.com/english/advisories/2006/1831 · Note
• http://securitytracker.com/id?1016109 · Note