CVE-2011-4675: Path Traversal

Published Dec 5, 2011

Updated

The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.

Affected Software

20 affected components

Widelands Widelands=build1

Widelands Widelands=build10

Widelands Widelands=build10_release_candidate

Widelands Widelands=build11

Widelands Widelands=build11_release_candidate

Widelands Widelands=build12

Widelands Widelands=build12_release_candidate

Widelands Widelands=build13

Widelands Widelands=build13_release_candidate

Widelands Widelands=build13_release_candidate2

Widelands Widelands=build14

Widelands Widelands=build14_release_candidate

Widelands Widelands=build2

Widelands Widelands=build3

Widelands Widelands=build4

Widelands Widelands=build5

Widelands Widelands=build6

Widelands Widelands=build7

Widelands Widelands=build8

Widelands Widelands=build9

Remediation

Patch Available

http://bazaar.launchpad.net/~widelands-dev/widelands/build-15/revision/5021

Event History

Dec 5, 2011

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4675?

The severity of CVE-2011-4675 is classified as medium.

How do I fix CVE-2011-4675?

To fix CVE-2011-4675, upgrade Widelands to version 15.1 or later.

What affects CVE-2011-4675?

CVE-2011-4675 affects Widelands versions prior to 15.1.

What type of vulnerability is CVE-2011-4675?

CVE-2011-4675 is a pathname canonicalization vulnerability.

Who can exploit CVE-2011-4675?

Remote attackers can exploit CVE-2011-4675 to manipulate pathname generation.