CVE-2006-2479: Medium severity Bitrix Bitrix Site Manager vulnerability
The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2479?
CVE-2006-2479 has a high severity rating due to the potential for remote attackers to execute arbitrary PHP code.
How do I fix CVE-2006-2479?
To fix CVE-2006-2479, ensure that you are using a version of Bitrix Site Manager that has addressed this vulnerability by validating downloaded updates.
Which versions of Bitrix Site Manager are affected by CVE-2006-2479?
CVE-2006-2479 affects Bitrix Site Manager versions from 4.0.0 to 4.1.0.
What are the potential risks if CVE-2006-2479 is exploited?
If exploited, CVE-2006-2479 can lead to unauthorized access to sensitive information and the execution of malicious code.
Is there a workaround for CVE-2006-2479 if I cannot update?
A possible workaround for CVE-2006-2479 is to limit external DNS requests or to monitor updates closely to avoid redirecting to malicious sites.