CVE-2005-3330: Input Validation
First published: Thu Oct 27 2005(Updated: )
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Snoopy project Snoopy | =1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/15213
- http://www.osvdb.org/20316
- http://securitytracker.com/id?1015104
- http://secunia.com/advisories/17330
- https://svn.ampache.org/branches/3.3.1/docs/CHANGELOG
- http://secunia.com/advisories/17779
- http://sourceforge.net/project/shownotes.php?release_id=375385
- http://secunia.com/advisories/17887
- http://sourceforge.net/project/shownotes.php?release_id=368750
- http://secunia.com/advisories/17455
- http://securityreason.com/securityalert/117
- http://www.vupen.com/english/advisories/2005/2202
- http://www.vupen.com/english/advisories/2005/2727
- http://www.vupen.com/english/advisories/2005/2335
- http://marc.info/?l=bugtraq&m=113028858316430&w=2
- http://marc.info/?l=bugtraq&m=113062897231412&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22874
Frequently Asked Questions
What is the severity of CVE-2005-3330?
CVE-2005-3330 is considered a critical vulnerability due to the potential for command execution by remote attackers.
How do I fix CVE-2005-3330?
To mitigate CVE-2005-3330, update the Snoopy library to a version that is not affected or apply relevant patches.
What types of software are affected by CVE-2005-3330?
CVE-2005-3330 affects multiple software products including MagpieRSS, WordPress, Ampache, and Jinzora that use Snoopy 1.2.
Can CVE-2005-3330 lead to a complete system compromise?
Yes, CVE-2005-3330 can allow an attacker to execute arbitrary commands, which may lead to complete system compromise.
Is CVE-2005-3330 still a threat in modern applications?
While many applications have been updated, CVE-2005-3330 remains a threat in legacy systems that still utilize the vulnerable version of Snoopy.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- vendor/snoopy
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/snoopy project snoopy
- version/snoopy project snoopy/1.2