MaxMind GeoIP 'geoipupdate-pureperl.pl' Unspecified Directory Traversal Vulnerability
BID:47937
Info
MaxMind GeoIP 'geoipupdate-pureperl.pl' Unspecified Directory Traversal Vulnerability
| Bugtraq ID: | 47937 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 2011 12:00AM |
| Updated: | May 20 2011 12:00AM |
| Credit: | Anthon Pang |
| Vulnerable: |
Maxmind geoip 1.4.7 Maxmind geoip 1.4.5 |
| Not Vulnerable: | |
Discussion
MaxMind GeoIP 'geoipupdate-pureperl.pl' Unspecified Directory Traversal Vulnerability
MaxMind GeoIP is prone to an unspecified directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
An attacker can likely exploit this vulnerability to overwrite arbitrary files from the vulnerable computer in the context of the affected application. This may result in denial-of-service conditions; other attacks may also be possible.
GeoIP 1.4.5 is vulnerable; other versions may also be affected.
MaxMind GeoIP is prone to an unspecified directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
An attacker can likely exploit this vulnerability to overwrite arbitrary files from the vulnerable computer in the context of the affected application. This may result in denial-of-service conditions; other attacks may also be possible.
GeoIP 1.4.5 is vulnerable; other versions may also be affected.
Exploit / POC
MaxMind GeoIP 'geoipupdate-pureperl.pl' Unspecified Directory Traversal Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
MaxMind GeoIP 'geoipupdate-pureperl.pl' Unspecified Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
MaxMind GeoIP 'geoipupdate-pureperl.pl' Unspecified Directory Traversal Vulnerability
References:
References:
- CVE Request: GeoIP Directory traversal weakness in geoipupdate (Anthon Pang)
- geoip Homepage (Maxmind)