WeBWorK Remote Arbitrary Command Execution Vulnerability

Bugtraq ID:	16371
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jan 24 2006 12:00AM
Updated:	Feb 07 2006 08:55PM
Credit:	Reported by the vendor.
Vulnerable:	WeBWorK Online Homework Delivery System WeBWorK 2.1.3
Not Vulnerable:	WeBWorK Online Homework Delivery System WeBWorK 2.1.4

WeBWorK Remote Arbitrary Command Execution Vulnerability


WeBWorK is prone to a remote arbitrary command-execution vulnerability. This may facilitate remote unauthorized access to the server.

WeBWorK 2.1.3 is reportedly vulnerable. Other versions may be affected as well.

WeBWorK Remote Arbitrary Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

WeBWorK Remote Arbitrary Command Execution Vulnerability

Solution:

The vendor has released WeBWork 2.1.4 to address this issue.


WeBWorK Online Homework Delivery System WeBWorK 2.1.3

• WeBWorK Online Homework Delivery System webwork-2.1.4.tar.gz
  http://prdownloads.sourceforge.net/openwebwork/webwork-2.1.4.tar.gz?do wnload

WeBWorK Remote Arbitrary Command Execution Vulnerability

References:

• WeBWorK 2.1.4 (WeBWorK Online Homework Delivery System)
  
• WeBWorK Home Page (WeBWorK Online Homework Delivery System)