CVE-2001-1130: High severity SUSE SuSE Linux vulnerability

Published Aug 2, 2001

Updated

Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTPREFERER variable) to point to the directory that contains the keylist.txt file.

Affected Software

6 affected components

SUSE SuSE Linux=7.2

SUSE SuSE Linux=6.0

SUSE SuSE Linux=7.0

SUSE SuSE Linux=7.1

SUSE SuSE Linux=6.3

SUSE SuSE Linux=6.4

Remediation

Patch Available

http://www.securityfocus.com/archive/1/201216

Event History

Aug 2, 2001

CVE Published

04:00 AM

Jun 25, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1130?

CVE-2001-1130 is considered to have a moderate severity level due to its potential for command execution by remote attackers.

How do I fix CVE-2001-1130?

To fix CVE-2001-1130, you should upgrade your SUSE Linux installation to a version that is not affected by the vulnerability.

What versions of SUSE Linux are affected by CVE-2001-1130?

CVE-2001-1130 affects SUSE Linux versions 6.0 through 7.2.

What kind of attack does CVE-2001-1130 enable?

CVE-2001-1130 enables remote attackers to execute arbitrary commands on affected SUSE Linux systems.

What component is vulnerable in CVE-2001-1130?

The vulnerable component in CVE-2001-1130 is sdbsearch.cgi, which improperly handles the HTTP_REFERER variable.