OSSP Shiela Shell Command Execution Vulnerability
BID:19199
CVE-2006-3633 |Info
OSSP Shiela Shell Command Execution Vulnerability
| Bugtraq ID: | 19199 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-3633 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 27 2006 12:00AM |
| Updated: | Jul 28 2006 07:22PM |
| Credit: | Brian Caswell of Sourcefire discovered this issue. |
| Vulnerable: |
OSSP Sheila 1.1.5 OSSP Sheila 1.1.4 OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.4 OpenPKG OpenPKG 2.3 OpenPKG OpenPKG 2.2 OpenPKG OpenPKG 2.1 OpenPKG OpenPKG 2.0 OpenPKG OpenPKG Current |
| Not Vulnerable: |
OSSP Sheila 1.1.7 |
Discussion
OSSP Shiela Shell Command Execution Vulnerability
OSSP Shiela is prone to a vulnerability that may permit the execution of arbitrary shell commands. This issue is due to the application's failure to properly sanitize user-supplied input before using it in a 'system()' function call.
This issue allows attackers to execute arbitrary shell commands with the privileges of users executing a vulnerable version of the application.
This issue reportedly affects versions 1.1.5 and prior; other versions may also be affected.
OSSP Shiela is prone to a vulnerability that may permit the execution of arbitrary shell commands. This issue is due to the application's failure to properly sanitize user-supplied input before using it in a 'system()' function call.
This issue allows attackers to execute arbitrary shell commands with the privileges of users executing a vulnerable version of the application.
This issue reportedly affects versions 1.1.5 and prior; other versions may also be affected.
Exploit / POC
OSSP Shiela Shell Command Execution Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
OSSP Shiela Shell Command Execution Vulnerability
Solution:
The vendor has released version 1.1.7 to address this issue.
Please see the referenced advisories for more information.
OSSP Sheila 1.1.4
OSSP Sheila 1.1.5
Solution:
The vendor has released version 1.1.7 to address this issue.
Please see the referenced advisories for more information.
OSSP Sheila 1.1.4
-
OSSP shiela-1.1.7.tar.gz
ftp://ftp.ossp.org/pkg/tool/shiela/shiela-1.1.7.tar.gz
OSSP Sheila 1.1.5
-
OSSP shiela-1.1.7.tar.gz
ftp://ftp.ossp.org/pkg/tool/shiela/shiela-1.1.7.tar.gz