PT-2006-3274 · Eserv · Eserv/3

Tan Chew Keong · Published 2006-06-02 · Updated 2018-10-18 · CVE-2006-2309

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EServ/3 version 3.25

Description The issue allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files.

Recommendations For EServ/3 version 3.25, consider restricting access to the HTTP service until a patch is available. As a temporary workaround, avoid using the HTTP service with crafted requests containing dot, space, and slash characters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-2309

Affected Products

Eserv/3

References · 10

• http://secunia.com/advisories/20059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2309 · Security Note
• http://securityfocus.com/bid/18179 · Patch
• http://secunia.com/secunia_research/2006-37/advisory · Vendor Advisory
• http://eserv.ru/ru/news/news_detail.php?ID=235 · Patch
• http://securityreason.com/securityalert/1006 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2309 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26741 · Note
• http://vupen.com/english/advisories/2006/2066 · Note
• http://securityfocus.com/archive/1/435415/100/0/threaded · Note