PT-2007-3570 · University Of Michigan · Cosign

Published 2007-04-25 · Updated 2018-10-16 · CVE-2007-2233

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cosign versions 2.0.2 and earlier

Description The issue allows remote authenticated users to perform unauthorized actions as an arbitrary user. This is achieved by using CR (r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

Recommendations For Cosign versions 2.0.2 and earlier, update to a version later than 2.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the cosign-bin/cosign.cgi script to minimize the risk of exploitation. Avoid using the service parameter in the affected script until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2233

Affected Products

Cosign

References · 6

• 🔥 https://exploit-db.com/exploits/29844 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2233 · Security Note
• http://secunia.com/advisories/24845 · Vendor Advisory
• http://umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt · Vendor Advisory
• http://vupen.com/english/advisories/2007/1359 · Note
• http://securityfocus.com/archive/1/465386/100/100/threaded · Note