PT-2008-6757 · Verlihub · Verlihub

V4Lkyrius · Published 2008-12-22 · Updated 2017-09-29 · CVE-2008-5705

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Verlihub versions 0.9.8d-RC2 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an argument when user triggers are enabled. This is due to a problem in the cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon.

Recommendations For Verlihub versions 0.9.8d-RC2 and earlier, consider disabling the cTrigger::DoIt function or user triggers until a patch is available to prevent the execution of arbitrary commands. Restrict access to the trigger mechanism to minimize the risk of exploitation. Avoid using arguments that contain shell metacharacters in the affected function.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5705

Affected Products

Verlihub

References · 7

• 🔥 https://exploit-db.com/exploits/7183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5705 · Security Note
• http://bugs.debian.org/506530 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46801 · Note
• http://securityreason.com/securityalert/4800 · Note
• http://securityfocus.com/bid/32420 · Note
• http://openwall.com/lists/oss-security/2008/12/17/16 · Note