CVE-2006-2550 - perlpodder before 0.5 allows remote attackers to execute arbitrary code via shell metacharacters in

CVE-2006-2550

Summary

perlpodder before 0.5 allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast, which are executed when saving the URL to a log file. NOTE: the wget vector is already covered by CVE-2006-2548.

References

Vulnerable Configurations

cpe:2.3:a:perlpodder:perlpodder:0.2:*:*:*:*:*:*:*
cpe:2.3:a:perlpodder:perlpodder:0.2:*:*:*:*:*:*:*
cpe:2.3:a:perlpodder:perlpodder:0.3:*:*:*:*:*:*:*
cpe:2.3:a:perlpodder:perlpodder:0.3:*:*:*:*:*:*:*
cpe:2.3:a:perlpodder:perlpodder:*:*:*:*:*:*:*:*
cpe:2.3:a:perlpodder:perlpodder:*:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 18-10-2018 - 16:40)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

bid	18067
bugtraq	20060522 Perlpodder Remote Arbitrary Command Execution
fulldisc	20060522 Perlpodder Remote Arbitrary Command Execution
misc	http://www.redteam-pentesting.de/advisories/rt-sa-2006-003.php
osvdb	25708
secunia	20238
vupen	ADV-2006-1906
xf	perlpodder-dlset-command-execution(26575)

Last major update

18-10-2018 - 16:40

Published

23-05-2006 - 10:06

Last modified

18-10-2018 - 16:40