CVE-2009-1669: Input Validation
First published: Mon May 18 2009(Updated: )
The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Smarty | =2.6.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/34918
- http://secunia.com/advisories/35072
- http://osvdb.org/54380
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01274.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01283.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01287.html
- http://secunia.com/advisories/35219
- http://www.ubuntu.com/usn/usn-791-3
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50457
- https://www.exploit-db.com/exploits/8659
Frequently Asked Questions
What is the severity of CVE-2009-1669?
CVE-2009-1669 is classified as high severity due to its potential to allow arbitrary command execution.
How do I fix CVE-2009-1669?
Fixing CVE-2009-1669 involves upgrading to a version of Smarty that is not vulnerable, specifically a version later than 2.6.22.
What systems are affected by CVE-2009-1669?
CVE-2009-1669 affects Smarty version 2.6.22 and possibly earlier versions.
What kind of attack is possible with CVE-2009-1669?
CVE-2009-1669 allows context-dependent attackers to execute arbitrary commands through shell metacharacters in the equation attribute.
Who is impacted by CVE-2009-1669?
Developers using versions of Smarty 2.6.22 and earlier are at risk from CVE-2009-1669 if they allow untrusted input.
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- agent/event
- vendor/smarty
- canonical/smarty
- version/smarty/2.6.22