| | site-map | e-mail

User:

Guest

Name: Password:

www.center.hu / Archive / Security news / january, 2005 / TWiki search string parsing vulnerability 

TWiki search string parsing vulnerability

TWiki search string parsing vulnerability

Date Discovered: November 24, 2004
Date Published: January 9, 2005
Last Updated: January 9, 2005


Vulnerability ID: 31966
Discovered by: anonymous
Exploitable Locally: No
Exploitable Remotely: Yes
Impact: Remote attackers can execute arbitrary code.
Root Cause: Software Vulnerability


TWiki contains a vulnerability that can allow remote attackers to execute arbitrary commands. The vulnerability is due to improper filtering of search strings by the search function. Remote attackers can exploit this vulnerability using shell metacharacters and execute arbitrary code.


Recommendations

GLSA 200411-33
Upgrade to www-apps/twiki-20040902 or later from the vendor.


Vendor advisory:

GLSA 200411-33


Affected Technologies


Gentoo Technologies, Inc. : Gentoo Linux 1.4
Gentoo Technologies, Inc. : Gentoo Linux 1.4 rc1
Gentoo Technologies, Inc. : Gentoo Linux 1.4 rc2
Gentoo Technologies, Inc. : Gentoo Linux 1.4 rc3


References


Mitre CVE: CAN-2004-1037

More information on CA Virus Information Center: 
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=31966

Computer Associates – the Trusted Source of Security Knowledge

2005-01-10 09:22

Back