BID:3988

Netjuke Remote Command Execution Vulnerability

Info

Netjuke Remote Command Execution Vulnerability

Bugtraq ID:	3988
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 26 2002 12:00AM
Updated:	Jan 26 2002 12:00AM
Credit:	Published in a Netjuke changelog.
Vulnerable:	Netjuke Netjuke 1.0 b6 Netjuke Netjuke 1.0 b5 Netjuke Netjuke 1.0 b4 Netjuke Netjuke 1.0 b3 Netjuke Netjuke 1.0 b2 Netjuke Netjuke 1.0 b1

Not Vulnerable:	Netjuke Netjuke 1.0 b7

Discussion

Netjuke Remote Command Execution Vulnerability

Netjuke is a web based audio streaming jukebox program which supports MP3, Ogg Vorbis, and other music file formats.

An issue exists in versions of Netjuke prior to 1.0b7 which could enable remote attackers to execute arbitrary commands as the web server user. Exploitation of this issue could lead to a compromise of the host.

This issue is the result of insufficient validation of user input passed to the 'section' variable.

Exploit / POC

Netjuke Remote Command Execution Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Netjuke Remote Command Execution Vulnerability

Solution:
Netjuke has released 1.0b6.2 patch for versions 1.0 b3 through b6 which will address this issue. However, it is recommended to upgrade to 1.0b7 which also addresses this issue:

Netjuke Netjuke 1.0 b6