Snoopy Arbitrary Command Execution Vulnerability
BID:15213
Info
Snoopy Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 15213 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3330 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 26 2005 12:00AM |
| Updated: | Sep 10 2008 07:01PM |
| Credit: | D. Fabian of SEC-CONSULT is credited with the discovery of this issue. |
| Vulnerable: |
Snoopy Snoopy 1.2 Snoopy Snoopy 1.0 1 Snoopy Snoopy 0.94 Snoopy Snoopy 0.93 Snoopy Snoopy 0.92 Snoopy Snoopy 0.91 |
| Not Vulnerable: |
Snoopy Snoopy 1.2.1 |
Discussion
Snoopy Arbitrary Command Execution Vulnerability
Snoopy is prone to a vulnerability that lets attackers execute arbitrary commands because the application fails to properly sanitize user-supplied input.
This issue may facilitate unauthorized remote access to the application in the context of the webserver.
Snoopy is prone to a vulnerability that lets attackers execute arbitrary commands because the application fails to properly sanitize user-supplied input.
This issue may facilitate unauthorized remote access to the application in the context of the webserver.
Exploit / POC
Snoopy Arbitrary Command Execution Vulnerability
No exploit is required.
The following proof-of-concept URI is available:
https://www.%22;+echo+'hello'+%3E+test.txt
Passing this URI to a script that uses a vulnerable version of Snoopy will result in a file called 'test.txt' containing 'hello'.
No exploit is required.
The following proof-of-concept URI is available:
https://www.%22;+echo+'hello'+%3E+test.txt
Passing this URI to a script that uses a vulnerable version of Snoopy will result in a file called 'test.txt' containing 'hello'.
Solution / Fix
Snoopy Arbitrary Command Execution Vulnerability
Solution:
The vendor has released Snoopy 1.2.1 to address this issue:
Snoopy Snoopy 0.91
Snoopy Snoopy 0.92
Snoopy Snoopy 0.93
Snoopy Snoopy 0.94
Snoopy Snoopy 1.0 1
Snoopy Snoopy 1.2
Solution:
The vendor has released Snoopy 1.2.1 to address this issue:
Snoopy Snoopy 0.91
-
Snoopy Snoopy-1.2.1.tar.gz
http://prdownloads.sourceforge.net/snoopy/Snoopy-1.2.1.tar.gz?download
Snoopy Snoopy 0.92
-
Snoopy Snoopy-1.2.1.tar.gz
http://prdownloads.sourceforge.net/snoopy/Snoopy-1.2.1.tar.gz?download
Snoopy Snoopy 0.93
-
Snoopy Snoopy-1.2.1.tar.gz
http://prdownloads.sourceforge.net/snoopy/Snoopy-1.2.1.tar.gz?download
Snoopy Snoopy 0.94
-
Snoopy Snoopy-1.2.1.tar.gz
http://prdownloads.sourceforge.net/snoopy/Snoopy-1.2.1.tar.gz?download
Snoopy Snoopy 1.0 1
-
Snoopy Snoopy-1.2.1.tar.gz
http://prdownloads.sourceforge.net/snoopy/Snoopy-1.2.1.tar.gz?download
Snoopy Snoopy 1.2
-
Snoopy Snoopy-1.2.1.tar.gz
http://prdownloads.sourceforge.net/snoopy/Snoopy-1.2.1.tar.gz?download
References
Snoopy Arbitrary Command Execution Vulnerability
References:
References: