RVSiteBuilder Unspecified Privilege Escalation and Arbitrary File Overwrite Vulnerabilities

Bugtraq ID:	62153
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2013 12:00AM
Updated:	Sep 03 2013 12:00AM
Credit:	Rack911
Vulnerable:	RV Global Soft RVSiteBuilder 5.0.39
Not Vulnerable:	RV Global Soft RVSiteBuilder 5.0.40

RVSiteBuilder Unspecified Privilege Escalation and Arbitrary File Overwrite Vulnerabilities

RVSiteBuilder is prone to unspecified privilege-escalation and arbitrary file-overwrite vulnerabilities.

An attacker can exploit these issues to gain root privileges or overwrite arbitrary files in the context of the user running the affected application. This may aid in further attacks.

RVSiteBuilder 5.0.391 is vulnerable; prior versions may also be affected.

RVSiteBuilder Unspecified Privilege Escalation and Arbitrary File Overwrite Vulnerabilities

An attacker can exploit these issues using a web browser.

RVSiteBuilder Unspecified Privilege Escalation and Arbitrary File Overwrite Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

RVSiteBuilder Unspecified Privilege Escalation and Arbitrary File Overwrite Vulnerabilities

References:

• RVSiteBuilder �?? Arbitrary File Overwrite (R911-0061) (RV Global Soft)
  
• RVSiteBuilder �?? Hardlink Local Privilege Escalation (R911-0062) (RV Global Soft)
  
• RVSiteBuilder Changelog (RV Global Soft)
  
• RVSiteBuilder Homepage (RV Global Soft)