Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New mldonkey packages fix information disclosure |
| Informations | |||
|---|---|---|---|
| Name | DSA-1739 | First vendor Publication | 2009-03-13 |
| Vendor | Debian | Last vendor Modification | 2009-03-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It has been discovered that mldonkey, a client for several P2P networks, allows attackers to download arbitrary files using crafted requests to the HTTP console. For the stable distribution (etch), this problem has been fixed in version 2.9.5-2+lenny1. For the unstable distribution (sid), this problem will be fixed soon. The old stable distribution (etch) is not affected by this problem. We recommend that you upgrade your mldonkey packages. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1739 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13453 | |||
| Oval ID: | oval:org.mitre.oval:def:13453 | ||
| Title: | DSA-1739-1 mldonkey -- path traversal | ||
| Description: | It has been discovered that mldonkey, a client for several P2P networks, allows attackers to download arbitrary files using crafted requests to the HTTP console. For the stable distribution, this problem has been fixed in version 2.9.5-2+lenny1. For the unstable distribution, this problem will be fixed soon. The old stable distribution is not affected by this problem. We recommend that you upgrade your mldonkey packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1739-1 CVE-2009-0753 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | mldonkey |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:8205 | |||
| Oval ID: | oval:org.mitre.oval:def:8205 | ||
| Title: | DSA-1739 mldonkey -- path traversal | ||
| Description: | It has been discovered that mldonkey, a client for several P2P networks, allows attackers to download arbitrary files using crafted requests to the HTTP console. The old stable distribution (etch) is not affected by this problem. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1739 CVE-2009-0753 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | mldonkey |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 5 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-31 | Name : Gentoo Security Advisory GLSA 200903-36 (mldonkey) File : nvt/glsa_200903_36.nasl |
| 2009-03-20 | Name : Debian Security Advisory DSA 1739-1 (mldonkey) File : nvt/deb_1739_1.nasl |
| 2009-03-20 | Name : Fedora Core 9 FEDORA-2009-2703 (mldonkey) File : nvt/fcore_2009_2703.nasl |
| 2009-03-20 | Name : Fedora Core 10 FEDORA-2009-2758 (mldonkey) File : nvt/fcore_2009_2758.nasl |
| 2009-03-17 | Name : MLdonkey HTTP Request Arbitrary File Download Vulnerability File : nvt/mldonkey_2_9_7_remote.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 52291 | MLDonkey src/utils/lib/url.ml Double Forward Slash URL Handling Arbitrary Fil... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-2758.nasl - Type : ACT_GATHER_INFO |
| 2009-03-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1739.nasl - Type : ACT_GATHER_INFO |
| 2009-03-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200903-36.nasl - Type : ACT_GATHER_INFO |
| 2009-03-17 | Name : The remote Fedora host is missing a security update. File : fedora_2009-2703.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:15 |
|
