CVE-2006-2479
First published: Fri May 19 2006(Updated: )
The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitrix Site Manager | =4.0.0 | |
| Bitrix Site Manager | =4.0.2 | |
| Bitrix Site Manager | =4.0.3 | |
| Bitrix Site Manager | =4.0.4 | |
| Bitrix Site Manager | =4.0.5 | |
| Bitrix Site Manager | =4.0.6 | |
| Bitrix Site Manager | =4.0.7 | |
| Bitrix Site Manager | =4.0.8 | |
| Bitrix Site Manager | =4.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1016121
- http://securityreason.com/securityalert/918
- http://www.vupen.com/english/advisories/2006/1858
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26548
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26542
- http://www.securityfocus.com/archive/1/434367/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2006-2479?
CVE-2006-2479 has a high severity rating due to the potential for remote attackers to execute arbitrary PHP code.
How do I fix CVE-2006-2479?
To fix CVE-2006-2479, ensure that you are using a version of Bitrix Site Manager that has addressed this vulnerability by validating downloaded updates.
Which versions of Bitrix Site Manager are affected by CVE-2006-2479?
CVE-2006-2479 affects Bitrix Site Manager versions from 4.0.0 to 4.1.0.
What are the potential risks if CVE-2006-2479 is exploited?
If exploited, CVE-2006-2479 can lead to unauthorized access to sensitive information and the execution of malicious code.
Is there a workaround for CVE-2006-2479 if I cannot update?
A possible workaround for CVE-2006-2479 is to limit external DNS requests or to monitor updates closely to avoid redirecting to malicious sites.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/bitrix
- canonical/bitrix site manager
- version/bitrix site manager/4.0.0
- version/bitrix site manager/4.0.2
- version/bitrix site manager/4.0.3
- version/bitrix site manager/4.0.4
- version/bitrix site manager/4.0.5
- version/bitrix site manager/4.0.6
- version/bitrix site manager/4.0.7
- version/bitrix site manager/4.0.8
- version/bitrix site manager/4.1.0