BID:20798

Ampache Guest Account Information Disclosure Vulnerability

Info

Ampache Guest Account Information Disclosure Vulnerability

Bugtraq ID:	20798
Class:	Environment Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 26 2006 12:00AM
Updated:	Oct 31 2006 05:27PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Ampache Ampache 3.3.2 Ampache Ampache 3.3.1 .2 Ampache Ampache 3.3.1 Ampache Ampache 3.3 Ampache Ampache 3.2.4 Ampache Ampache 3.2.3 Ampache Ampache 3.2.2 Ampache Ampache 3.2.1 Ampache Ampache 3.2

Not Vulnerable:	Ampache Ampache 3.3.2 .1

Discussion

Ampache Guest Account Information Disclosure Vulnerability

Ampache is prone to an information-disclosure vulnerability because it fails to properly handle exceptional conditions.

An attacker can exploit this issue to gain unauthorized access to the application; this may aid in further attacks.

Ampache 3.3.2 and prior versions are vulnerable.

Exploit / POC

Ampache Guest Account Information Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Due to the nature of this vulnerability, an attacker can likely exploit it via a web client.

Solution / Fix

Ampache Guest Account Information Disclosure Vulnerability

Solution:
The vendor has released version 3.3.2.1 to address this issue. Please see the references for more information.

Ampache Ampache 3.2