PT-2006-6633 · Verity · Verity Ultraseek

Sullo · Published 2006-11-18 · Updated 2018-10-17 · CVE-2006-5971

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Verity Ultraseek versions prior to 5.6.2

Description The issue allows remote attackers to read arbitrary files due to an absolute path traversal vulnerability in the admin/logfile.txt file. This is achieved by exploiting the name variable.

Recommendations For versions prior to 5.6.2, update to version 5.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/logfile.txt file to minimize the risk of exploitation. Avoid using the name variable in the affected file until the issue is resolved.

Fix

Related Identifiers

CVE-2006-5971

Affected Products

Verity Ultraseek

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-5971 · Security Note
• http://secunia.com/advisories/22892 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-06-042.html · Note
• http://ultraseek.com/support/docs/release_notes/ultraseek.5.6.2.txt · Note
• http://osvdb.org/30289 · Note
• http://ultraseek.com/support/docs/RELNOTES.txt · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5971 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30321 · Note
• http://securityfocus.com/archive/1/451847/100/0/threaded · Note