CVE-2006-3611: Medium severity Phorum Phorum vulnerability

Q: What is the severity of CVE-2006-3611?

CVE-2006-3611 is considered a critical vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2006-3611?

To fix CVE-2006-3611, you should upgrade Phorum to version 5.1.15 or later to eliminate the directory traversal vulnerability.

Q: Who is affected by CVE-2006-3611?

CVE-2006-3611 affects authenticated users of Phorum versions up to and including 5.1.14.

Q: What does CVE-2006-3611 exploit?

CVE-2006-3611 exploits a directory traversal vulnerability in the pm.php file of Phorum.

Q: Are there any workarounds for CVE-2006-3611?

A temporary workaround for CVE-2006-3611 includes restricting access to the pm.php file until a proper patch can be applied.

Published Jul 14, 2006

Updated

Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php.

Affected Software

62 affected components

Phorum Phorum<=5.1.14

Phorum Phorum=3.0.7

Phorum Phorum=3.1

Phorum Phorum=3.1.1

Phorum Phorum=3.1.1_pre

Phorum Phorum=3.1.1_rc2

Phorum Phorum=3.1.1a

Phorum Phorum=3.1.2

Phorum Phorum=3.2

Phorum Phorum=3.2.2

Phorum Phorum=3.2.3

Phorum Phorum=3.2.3a

Phorum Phorum=3.2.3b

Phorum Phorum=3.2.4

Phorum Phorum=3.2.5

Phorum Phorum=3.2.6

Phorum Phorum=3.2.7

Phorum Phorum=3.2.8

Phorum Phorum=3.3.1

Phorum Phorum=3.3.1a

Phorum Phorum=3.3.2

Phorum Phorum=3.3.2a

Phorum Phorum=3.3.2b3

Phorum Phorum=3.4

Phorum Phorum=3.4.1

Phorum Phorum=3.4.2

Phorum Phorum=3.4.3

Phorum Phorum=3.4.4

Phorum Phorum=3.4.5

Phorum Phorum=3.4.6

Phorum Phorum=3.4.7

Phorum Phorum=3.4.8

Phorum Phorum=3.4.8a

Phorum Phorum=4.3.7

Phorum Phorum=5.0.0_alpha

Phorum Phorum=5.0.1_alpha

Phorum Phorum=5.0.2_alpha

Phorum Phorum=5.0.3_beta

Phorum Phorum=5.0.4_beta

Phorum Phorum=5.0.4a_beta

Phorum Phorum=5.0.5_beta

Phorum Phorum=5.0.6_beta

Phorum Phorum=5.0.7_beta

Phorum Phorum=5.0.7a_beta

Phorum Phorum=5.0.8_rc

Phorum Phorum=5.0.9

Phorum Phorum=5.0.10

Phorum Phorum=5.0.11

Phorum Phorum=5.0.12

Phorum Phorum=5.0.13

Phorum Phorum=5.0.13a

Phorum Phorum=5.0.14

Phorum Phorum=5.0.14a

Phorum Phorum=5.0.15

Phorum Phorum=5.0.15a

Phorum Phorum=5.0.16

Phorum Phorum=5.0.17

Phorum Phorum=5.0.17a

Phorum Phorum=5.0.18

Phorum Phorum=5.0.19

Phorum Phorum=5.0.20

Phorum Phorum=5.1.13

Remediation

Patch Available

http://www.phorum.org/phorum5/read.php?14,114358

Event History

Jul 14, 2006

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3611?

CVE-2006-3611 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2006-3611?

To fix CVE-2006-3611, you should upgrade Phorum to version 5.1.15 or later to eliminate the directory traversal vulnerability.

Who is affected by CVE-2006-3611?