PT-2006-4986 · Apache · Apache+1

Sparfell · Published 2006-10-16 · Updated 2017-07-20 · CVE-2006-4154

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache 2.x with mod tcl module 1.0

Description The issue allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set var function call in files tcl cmds.c and tcl core.c.

Recommendations For Apache 2.x with mod tcl module 1.0, consider disabling the set var function in tcl cmds.c and tcl core.c until a patch is available. Restrict access to the mod tcl module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4154

Affected Products

Apache

Mod Tcl

References · 12

• http://security.gentoo.org/glsa/glsa-200610-12.xml · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4154 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29550 · Note
• http://secunia.com/advisories/22549 · Note
• http://securitytracker.com/id?1017062 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4154 · Note
• http://kb.cert.org/vuls/id/366020 · Note
• http://securityfocus.com/bid/20527 · Note
• http://vupen.com/english/advisories/2006/4033 · Note
• http://osvdb.org/29536 · Note
• http://secunia.com/advisories/22458 · Note