CVE-2006-6259 - Multiple directory traversal vulnerabilities in (a) class/functions.php and (b) class/m_bro.php in A

CVE-2006-6259

Summary

Multiple directory traversal vulnerabilities in (a) class/functions.php and (b) class/m_bro.php in AlternC 0.9.5 and earlier allow remote attackers to (1) create arbitrary files and directories via a .. (dot dot) in the "create name" field and (2) read arbitrary files via a .. (dot dot) in the "web root" field when configuring a subdomain.

References

Vulnerable Configurations

cpe:2.3:a:alternc:alternc:*:*:*:*:*:*:*:*
cpe:2.3:a:alternc:alternc:*:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 17-10-2018 - 21:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	21355
bugtraq	20061128 Multiple Vulnerabilities in AlternC version 0.9.5
confirm	http://dev.alternc.org/trac/alternc/changeset/1737 http://dev.alternc.org/trac/alternc/changeset/1738 http://dev.alternc.org/trac/alternc/changeset/1742 https://dev.alternc.org/trac/alternc/milestone/0.9.6
misc	http://www.ground418.org/exploits/read.php?file=06-alternC-095.txt
secunia	23144
sreason	1965
vupen	ADV-2006-4851
xf	alternc-multiple-directory-traversal(30626)

Last major update

17-10-2018 - 21:47

Published

04-12-2006 - 11:28

Last modified

17-10-2018 - 21:47