CVE-2005-3539
First published: Sat Dec 31 2005(Updated: )
Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hylafax+ | =4.1.1 | |
| Hylafax+ | =4.2 | |
| Hylafax+ | =4.2.1 | |
| Hylafax+ | =4.2.2 | |
| Hylafax+ | =4.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719
- http://www.hylafax.org/content/HylaFAX_4.2.4_release
- http://www.securityfocus.com/bid/16151
- http://www.gentoo.org/security/en/glsa/glsa-200601-03.xml
- http://secunia.com/advisories/18314
- http://secunia.com/advisories/18337
- http://www.debian.org/security/2005/dsa-933
- http://secunia.com/advisories/18366
- http://secunia.com/advisories/18489
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:015
- http://www.vupen.com/english/advisories/2006/0072
- http://www.securityfocus.com/archive/1/420974/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3539?
CVE-2005-3539 has a medium severity rating due to the potential for remote command execution.
How do I fix CVE-2005-3539?
To fix CVE-2005-3539, upgrade to HylaFAX version 4.2.4 or later.
What versions of HylaFAX are affected by CVE-2005-3539?
CVE-2005-3539 affects HylaFAX versions 4.2.0 to 4.2.3.
What type of vulnerabilities are present in CVE-2005-3539?
CVE-2005-3539 contains multiple eval injection vulnerabilities that allow arbitrary command execution.
Can CVE-2005-3539 be exploited remotely?
Yes, CVE-2005-3539 can be exploited remotely by attackers.
- agent/type
- agent/references
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/hylafax
- canonical/hylafax+
- version/hylafax+/4.2.1
- version/hylafax+/4.2.2
- version/hylafax+/4.1.1
- version/hylafax+/4.2
- version/hylafax+/4.2.3