| CVE-2008-1319 |
|
发布时间 :2008-03-13 10:44:00 | ||
| 修订时间 :2011-03-07 22:06:42 | ||||
| NMCOE |
[原文]Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier, as used in Borland CaliberRM and probably other products, allows remote attackers to execute arbitrary commands via a request to TCP port 5019 with a modified VERSANT_ROOT field.
[CNNVD]Versant Object Database Borland CaliberRM 不可靠搜索路径和变量注入漏洞(CNNVD-200803-214)
Versant Object Database存在不可靠搜索路径和变量注入漏洞，在Borland CaliberRM和其他可能产品中运行时。远程攻击者通过请求到达具有一个修改过的VERSANT_ROOT字段的TCP端口5019，以执行任意命令。
–
CVSS (基础分值)
| CVSS分值: | 9.3 | [严重(HIGH)] |
| 机密性影响: | COMPLETE | [完全的信息泄露导致所有系统文件暴露] |
| 完整性影响: | COMPLETE | [系统完整性可被完全破坏] |
| 可用性影响: | COMPLETE | [可能导致系统完全宕机] |
| 攻击复杂度: | MEDIUM | [漏洞利用存在一定的访问条件] |
| 攻击向量: | NETWORK | [攻击者不需要获取内网访问权或本地访问权] |
| 身份认证: | NONE | [漏洞利用无需身份认证] |
–
CPE (受影响的平台与产品)
| cpe:/a:versant:versant_object_database:7.0.1 | |
| cpe:/a:versant:versant_object_database:7.0.1.3 |
–
OVAL (用于检测的技术细节)
| 未找到相关OVAL定义 |
–
官方数据库链接
–
其它链接及资源
|
http://xforce.iss.net/xforce/xfdb/40997 (UNKNOWN) XF objectdatabase-versantd-cmd-execution(40997) |
|
http://www.vupen.com/english/advisories/2008/0764/references (UNKNOWN) VUPEN ADV-2008-0764 |
|
http://www.securityfocus.com/bid/28097 (UNKNOWN) BID 28097 |
|
http://www.securityfocus.com/archive/1/archive/1/489139/100/0/threaded (UNKNOWN) BUGTRAQ 20080304 Arbitrary commands execution in Versant Object Database 7.0.1.3 |
|
http://www.milw0rm.com/exploits/5213 (UNKNOWN) MILW0RM 5213 |
|
http://securityreason.com/securityalert/3738 (UNKNOWN) SREASON 3738 |
|
http://secunia.com/advisories/29230 (VENDOR_ADVISORY) SECUNIA 29230 |
|
http://marc.info/?l=bugtraq&m=120468784112145&w=2 (UNKNOWN) BUGTRAQ 20080304 Arbitrary commands execution in Versant Object Database 7.0.1.3 |
|
http://aluigi.altervista.org/adv/versantcmd-adv.txt (UNKNOWN) MISC http://aluigi.altervista.org/adv/versantcmd-adv.txt |
–
漏洞信息
| Versant Object Database Borland CaliberRM 不可靠搜索路径和变量注入漏洞 | |
| 高危 | 设计错误 |
| 2008-03-13 00:00:00 | 2008-09-05 00:00:00 |
| 远程 | |
| Versant Object Database存在不可靠搜索路径和变量注入漏洞，在Borland CaliberRM和其他可能产品中运行时。远程攻击者通过请求到达具有一个修改过的VERSANT_ROOT字段的TCP端口5019，以执行任意命令。 | |
–
公告与补丁
|
目前厂商还没有提供补丁或者升级程序，建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.versant.com/ |
–
漏洞信息 (5213)
| Versant Object Database <= 7.0.1.3 Commands Execution Exploit (EDBID:5213) | |
| windows | remote |
| 2008-03-04 | Verified |
| 0 | Luigi Auriemma |
N/A |
[点击下载] |
Versant server <= 7.0.1.3 Arbitrary Commands Execution Exploit http://www.exploit-db.com/sploits/2008-versantcmd.zip # milw0rm.com [2008-03-04]
-
漏洞信息
43063 |
|
| Versant Object Database VERSANTD Service Remote Command Execution | |
Remote / Network Access |
|
| Exploit Public | |
-
漏洞描述
-
时间线
2008-03-04 |
Unknow |
| 2008-03-04 | Unknow |
![[奥运] 欧美华人今日举行最大规模反"藏._.毒"集会-微慑信息网-VulSee.com](http://img1.qq.com/news/pics/9831/9831494.jpg)
![[八卦] 王婷婷—揭秘一个大三女生的性爱录像-微慑信息网-VulSee.com](http://free.86hy.com/crack/pic/1.jpg)
![[随笔]今天国际警察节-微慑信息网-VulSee.com](http://photo.sohu.com/20041017/Img222528326.jpg)
青云网
