PT-2015-4921 · Debian+1 · Smokeping+1

Tero Marttila · Published 2015-11-25 · Updated 2015-12-04 · CVE-2015-0859

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions smokeping versions prior to 2.6.8-2+deb7u1 in wheezy smokeping versions prior to 2.6.9-1+deb8u1 in jessie

Description The issue arises from the Debian build procedure for the smokeping package, which does not properly configure how Apache httpd passes arguments to smokeping cgi. This allows remote attackers to execute arbitrary code via crafted CGI arguments.

Recommendations For smokeping versions prior to 2.6.8-2+deb7u1 in wheezy, update to version 2.6.8-2+deb7u1 or later. For smokeping versions prior to 2.6.9-1+deb8u1 in jessie, update to version 2.6.9-1+deb8u1 or later.

Fix

RCE

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-0859

DSA-3405-1

Affected Products

Apache Httpd

Smokeping

References · 13

• https://cve.org/CVERecord?id=CVE-2015-0859 · Security Note
• https://osv.dev/vulnerability/DSA-3405-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3405-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0859 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0859 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0859 · Security Note
• http://debian.org/security/2015/dsa-3405 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-0859 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-0859 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/smokeping · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-0859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0859 · Vendor Advisory
• https://packages.debian.org/src:smokeping · Note