PT-2006-3461 · Apache+1 · Apache+2

Published 2006-05-22 · Updated 2017-07-20 · CVE-2006-2514

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Coppermine galleries versions prior to 1.4.6

Description The issue allows remote attackers to upload arbitrary files by utilizing a filename with multiple file extensions, specifically when the software is running on Apache with mod mime installed.

Recommendations For versions prior to 1.4.6, update to version 1.4.6 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the use of multiple file extensions in filenames until the update is applied.

Fix

Related Identifiers

CVE-2006-2514

Affected Products

Apache

Coppermine

Mod Mime

References · 6

• http://secunia.com/advisories/20211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2514 · Security Note
• http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26588 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2514 · Note
• http://vupen.com/english/advisories/2006/1892 · Note