PT-2008-2544 · Sword · The Sword Project Diatheke

Lubomir Kundrak · Published 2008-02-25 · Updated 2011-03-08 · CVE-2008-0932

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The SWORD Project Diatheke versions 1.5.9 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter. This can lead to unauthorized access and control of the system.

Recommendations For versions 1.5.9 and earlier, consider restricting access to the diatheke.pl script until a patch is available, and avoid using the range parameter with untrusted input.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-0932

DSA-1508-1

Affected Products

The Sword Project Diatheke

References · 17

• http://secunia.com/advisories/29115 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00806.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00769.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0932 · Vendor Advisory
• http://secunia.com/advisories/29012 · Vendor Advisory
• http://debian.org/security/2008/dsa-1508 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200803-06.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0932 · Security Note
• https://osv.dev/vulnerability/CVE-2008-0932 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0670/references · Note
• http://secunia.com/advisories/25400 · Note
• http://securityfocus.com/bid/27987 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=433723 · Note
• http://securityfocus.com/bid/27874 · Note