PT-2006-5652 · Microsoft+1 · Windows+1

Published 2006-09-22 · Updated 2021-04-09 · CVE-2006-4899

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CA eTrust Security Command Center versions 1.0 and r8 up to SP1 CR2

Description The issue allows remote attackers to obtain the web server path via a single quote in the PIProfile function, which leaks the path in an error message. This occurs when the ePPIServlet script is running on Windows.

Recommendations For CA eTrust Security Command Center versions 1.0 and r8 up to SP1 CR2, consider restricting access to the ePPIServlet script until a fix is available. As a temporary workaround, avoid using the PIProfile function with untrusted input to minimize the risk of path leakage.

Exploit

Fix

Related Identifiers

CVE-2006-4899

Affected Products

Ca Etrust Security Command Center

Windows

References · 13

• 🔥 http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt · Exploit
• 🔥 http://secunia.com/advisories/22023 · Exploit
• 🔥 https://exploit-db.com/exploits/28640 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4899 · Security Note
• http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9 · Note
• http://securityfocus.com/bid/20139 · Note
• http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34616 · Note
• http://osvdb.org/29009 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29102 · Note
• http://vupen.com/english/advisories/2006/3738 · Note
• http://securityfocus.com/archive/1/446611/100/0/threaded · Note
• http://securitytracker.com/id?1016910 · Note
• http://securityfocus.com/archive/1/446716/100/0/threaded · Note