Vulnerability Bulletins |
Salto de directorio en Adobe ColdFusion 8 |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de privilegios |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Comercial Software |
| Affected software |
ColdFusion 8 ColdFusion 8.0.1 FCKEditor |
Description |
|
|
Se han descubierto múltiples vulnerabilidades de salto de directorio en FCKeditor 2.6.4.1. Un atacante remoto podría subir ficheros en directorios arbitrarios mediante datos de entrada especialmente diseñados. |
|
Solution |
|
|
Actualización de software Adobe (APSB09-09) ColdFusion 8 / patch http://www.adobe.com/support/security/bulletins/downloads/hf801-77218.jar Debian (DSA-1836-1) Debian Linux 5.0 Source http://security.debian.org/pool/updates/main/f/fckeditor/fckeditor_2.6.2.orig.tar.gz http://security.debian.org/pool/updates/main/f/fckeditor/fckeditor_2.6.2-1lenny1.diff.gz http://security.debian.org/pool/updates/main/f/fckeditor/fckeditor_2.6.2-1lenny1.dsc Arquitectura independiente: http://security.debian.org/pool/updates/main/f/fckeditor/fckeditor_2.6.2-1lenny1_all.deb |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2009-2265 |
| BID | |
Other resources |
|
|
Adobe Security Bulletin (APSB09-09) http://www.adobe.com/support/security/bulletins/apsb09-09.html Debian Security Advisory (DSA-1836-1) http://lists.debian.org/debian-security-announce/2009/msg00150.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2009-07-09 |
| 1.1 | Aviso emitido por Debian (DSA-1836-1) | 2009-07-20 |