PT-2007-1017 · Debian · Sitebar

Stephane Bonnell · Published 2007-10-17 · Updated 2011-03-08 · CVE-2007-5491

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SiteBar version 3.3.8

Description: The issue concerns multiple vulnerabilities in the SiteBar package of the Debian GNU/Linux operating system, which can be exploited by a remote attacker who has passed the authentication procedure. This can lead to a breach of confidentiality, integrity, and availability of protected information. Specifically, a directory traversal vulnerability exists in the translation module, allowing remote authenticated users to modify permissions of arbitrary files via the lang parameter in translator.php by using ".." sequences.

Recommendations: For SiteBar version 3.3.8, consider restricting access to the translator.php file until a patch is available, and avoid using the lang parameter in the translation module to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2015-02683

CVE-2007-5491

DSA-1423-1

Affected Products

Sitebar

References · 17

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5692 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-5491 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5694 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200711-05.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5693 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5695 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5492 · Security Note
• https://bdu.fstec.ru/vul/2015-02683 · Security Note
• http://debian.org/security/2007/dsa-1423 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5491 · Security Note
• http://vupen.com/english/advisories/2007/3768 · Note
• http://secunia.com/advisories/27503 · Note
• http://securityfocus.com/bid/26126 · Note
• http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup · Note
• https://bugs.gentoo.org/show_bug.cgi?id=195810 · Note