CVE-2008-0932: Input Validation
First published: Thu Feb 21 2008(Updated: )
Description of problem: The Diatheke CGI allows arbitrary command execution in the context of the webserver, e.g. www-data by simply abusing the range parameter. For example, &range=`yes` will consume tons of resources on the affected webserver. Escalation of privleges and command shells are left as an exercise to the reader. From Debian: <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1 | |
| Debian | =3.1-r1 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Debian | =4.0 | |
| Fedora | =7 | |
| Fedora | =8 | |
| the SWORD Project | <=1.5.9 | |
| Sword | <=1.5.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2008/dsa-1508
- http://www.securityfocus.com/bid/27987
- http://secunia.com/advisories/29012
- http://secunia.com/advisories/25400
- https://bugzilla.redhat.com/show_bug.cgi?id=433723
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00769.html
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00806.html
- http://secunia.com/advisories/29115
- http://security.gentoo.org/glsa/glsa-200803-06.xml
- http://secunia.com/advisories/29181
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449
- http://www.securityfocus.com/bid/27874
- http://www.vupen.com/english/advisories/2008/0670/references
Frequently Asked Questions
What is the severity of CVE-2008-0932?
CVE-2008-0932 is classified as a high severity vulnerability due to its potential for arbitrary command execution on the web server.
How do I fix CVE-2008-0932?
To fix CVE-2008-0932, update the affected versions of Diatheke CGI and the SWORD Project software to the latest secure versions.
Which software is affected by CVE-2008-0932?
CVE-2008-0932 affects versions of Diatheke Front End and Sword up to 1.5.9.
What type of vulnerability is CVE-2008-0932?
CVE-2008-0932 is a command injection vulnerability that allows an attacker to execute arbitrary commands on the server.
Can CVE-2008-0932 lead to privilege escalation?
Yes, CVE-2008-0932 can potentially lead to privilege escalation, allowing attackers to gain higher access rights on the affected server.
- collector/nvd-historical
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/last-modified-date
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-0932
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/debian
- canonical/debian
- version/debian/3.1
- version/debian/3.1-r1
- version/debian/4.0
- vendor/redhat
- canonical/fedora
- version/fedora/7
- version/fedora/8
- vendor/the sword project
- canonical/the sword project
- version/the sword project/1.5.9
- canonical/sword
- version/sword/1.5.9