PT-2006-5993 · Asbru+1 · Asbru Website Manager+3

Published 2006-10-12 · Updated 2011-06-13 · CVE-2006-5258

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asbru Web Content Management versions prior to 6.1.22 Asbru Web Content Editor versions prior to 6.0.22 Asbru Website Manager versions prior to 6.0.22

Description The issue allows remote attackers to execute arbitrary commands due to a lack of sanitization in an unspecified parameter before invoking Aspell in the spell checking component.

Recommendations For Asbru Web Content Management versions prior to 6.1.22, update to version 6.1.22 or later. For Asbru Web Content Editor versions prior to 6.0.22, update to version 6.0.22 or later. For Asbru Website Manager versions prior to 6.0.22, update to version 6.0.22 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-5258

Affected Products

Asbru Web Content Editor

Asbru Web Content Management

Asbru Website Manager

Aspell

References · 11

• http://vupen.com/english/advisories/2006/4004 · Vendor Advisory
• http://secunia.com/advisories/22344 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4061 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4060 · Vendor Advisory
• http://secunia.com/advisories/22472 · Vendor Advisory
• http://wcm.asbrusoft.com/page.php/id=791 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5258 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0306.html · Note
• http://editor.asbrusoft.com/page.php/id=727 · Note
• http://secunia.com/advisories/22353 · Note
• http://securityfocus.com/bid/20544 · Note