Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-1512 | First vendor Publication | 2010-05-17 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1512 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11620 | |||
| Oval ID: | oval:org.mitre.oval:def:11620 | ||
| Title: | DSA-2047 aria2 -- insufficient input sanitising | ||
| Description: | A vulnerability was discovered in aria2, a download client. The "name" attribute of the "file" element of metalink files is not properly sanitised before using it to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2047 CVE-2010-1512 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | aria2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12962 | |||
| Oval ID: | oval:org.mitre.oval:def:12962 | ||
| Title: | DSA-2047-1 aria2 -- insufficient input sanitising | ||
| Description: | A vulnerability was discovered in aria2, a download client. The "name" attribute of the "file" element of metalink files is not properly sanitised before using it to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory. For the stable distribution, this problem has been fixed in version 0.14.0-1+lenny2. For the unstable distribution, this problem has been fixed in version 1.9.3-1. We recommend that you upgrade your aria2 package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2047-1 CVE-2010-1512 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | aria2 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-03-09 | Name : Gentoo Security Advisory GLSA 201101-04 (aria2) File : nvt/glsa_201101_04.nasl |
| 2010-06-03 | Name : Debian Security Advisory DSA 2047-1 (aria2) File : nvt/deb_2047_1.nasl |
| 2010-05-28 | Name : Fedora Update for aria2 FEDORA-2010-8908 File : nvt/gb_fedora_2010_8908_aria2_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for aria2 FEDORA-2010-8915 File : nvt/gb_fedora_2010_8915_aria2_fc11.nasl |
| 2010-05-28 | Name : Mandriva Update for aria2 MDVSA-2010:106 (aria2) File : nvt/gb_mandriva_MDVSA_2010_106.nasl |
| 2010-05-25 | Name : Aria2 metalink 'name' Directory Traversal Vulnerability File : nvt/gb_aria2_metalink_dir_traversal_vuln.nasl |
| 2010-03-22 | Name : Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer) File : nvt/gb_mandriva_MDVA_2010_106.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 64592 | aria2 metalink name Attribute Traversal Arbitrary File Creation aria2 contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the name attribute of the metalink file. This directory traversal attack would allow the attacker to create or replace files on the file system with arbitrary content. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-01-17 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201101-04.nasl - Type : ACT_GATHER_INFO |
| 2010-09-14 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_aria2-100902.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8905.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8908.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8915.nasl - Type : ACT_GATHER_INFO |
| 2010-06-25 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_aria2-100604.nasl - Type : ACT_GATHER_INFO |
| 2010-05-25 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2010-106.nasl - Type : ACT_GATHER_INFO |
| 2010-05-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2047.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:08:33 |
|
| 2024-11-28 12:21:47 |
|
| 2021-05-04 12:11:29 |
|
| 2021-04-22 01:12:05 |
|
| 2020-05-23 01:42:00 |
|
| 2020-05-23 00:25:41 |
|
| 2018-10-11 00:19:51 |
|
| 2016-06-28 18:08:46 |
|
| 2016-04-26 19:45:36 |
|
| 2014-02-17 10:55:00 |
|
| 2013-05-10 23:23:23 |
|
