PT-2011-1058 · Debian · Domain Technologie Control

Published 2011-03-07 · Updated 2017-08-17 · CVE-2011-0436

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Domain Technologie Control (DTC) versions prior to 0.32.9

Description The issue concerns multiple vulnerabilities in the DTC package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the register user function in client/new account form.php includes a cleartext password in an email message, making it easier for remote attackers to obtain sensitive information by sniffing the network.

Recommendations For versions prior to 0.32.9, update to version 0.32.9 or later to resolve the issue. As a temporary workaround, consider disabling the register user function in client/new account form.php to minimize the risk of exploitation. Restrict access to the client/new account form.php file to prevent unauthorized access.

Fix

SQL injection

Weakness Enumeration

CWE-89

CWE-310

Related Identifiers

BDU:2015-03561

CVE-2011-0436

DSA-2179-1

Affected Products

Domain Technologie Control

References · 18

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0434 · Security Note
• http://gplhost.sg/lists/dtcannounce/msg00025.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0436 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0437 · Security Note
• http://secunia.com/advisories/43523 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03561 · Security Note
• http://vupen.com/english/advisories/2011/0556 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0435 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-0436 · Security Note
• http://debian.org/security/2011/dsa-2179 · Vendor Advisory
• http://debian.org/security/dsa-2179 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65898 · Note
• http://openwall.com/lists/oss-security/2011/02/22/1 · Note
• http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614302 · Note