var-200612-0480
Vulnerability from variot
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file. Adobe Download Manager contains a buffer overflow. This vulnerability may allow a remote, unauthenticated attacker to run arbitrary code with the privileges of the affected user or cause a denial-of-service condition. Adobe ColdFusion is prone to an information-disclosure vulnerability. Successfully exploiting this issue allows remote attackers to gain access to the contents of arbitrary files that are not interpreted by ColdFusion. This includes the source of scripting files not handled by ColdFusion, configuration files, log files, and other data files. Information harvested may aid attackers in further attacks. Adobe ColdFusion MX7, 7.0.1 and 7.0.2 are vulnerable.
Secunia is proud to announce the availability of the Secunia Software Inspector.
The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. ".cfm". Other versions may also be affected.
SOLUTION: Apply hotfix (See vendor's advisory for details). Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability
iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007
I. BACKGROUND
Adobe Macromedia ColdFusion is an application server and development framework for websites. More information is available at the following URL.
http://www.adobe.com/products/coldfusion/
II. DESCRIPTION
Remote exploitation of an input validation vulnerability in Adobe Systems Inc.'s Macromedia ColdFusion MX 7 may allow an attacker to view file contents on the server.
The vulnerability specifically exists in that URL encoded filenames will be decoded by the IIS process and then again by the ColdFusion process. By supplying a URL containing a double encoded null byte and an extension handled by ColdFusion, such as '.cfm', it is possible to view the contents of any file which is not interpreted by ColdFusion.
III. Although this vulnerability does not in itself allow execution of code on the server, it may allow an attacker to discover sensitive information such as passwords or to discover vulnerabilities in other scripts on the system or potentially bypass some security restrictions.
IV. DETECTION
iDefense has confirmed this vulnerability exists in Adobe Macromedia ColdFusion MX 7.0.2, with all available fixes, running on Microsoft IIS vulnerable.
V. WORKAROUND
iDefense is unaware of any effective workarounds for this vulnerability.
VI. VENDOR RESPONSE
Adobe has released a patch for this issue. For more information consult their advisory at the link below.
http://www.adobe.com/support/security/bulletins/apsb07-02.html
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-5858 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
11/08/2006 Initial vendor notification 11/09/2006 Initial vendor response 01/09/2007 Coordinated public disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Inge Henriksen.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2006 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German.
The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios.
This includes: * Reason for rating * Extended description * Extended solution * Exploit code or links to exploit code * Deep links
Read the full description: http://corporate.secunia.com/products/48/?r=l
Contact Secunia Sales for more information: http://corporate.secunia.com/how_to_buy/15/?r=l
TITLE: Adobe Download Manager AOM Buffer Overflow Vulnerability
SECUNIA ADVISORY ID: SA23233
VERIFY ADVISORY: http://secunia.com/advisories/23233/
CRITICAL: Highly critical
IMPACT: System access
WHERE:
From remote
SOFTWARE: Adobe Download Manager 1.x http://secunia.com/product/7045/ Adobe Download Manager 2.x http://secunia.com/product/12814/
DESCRIPTION: A vulnerability has been reported in Adobe Download Manager, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error when handling section names in the "dm.ini" file as created by Adobe Download Manager when processing AOM files. This can be exploited to cause a stack-based buffer overflow via a specially crafted AOM or "dm.ini" file.
Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious website.
SOLUTION: Update to version 2.2.
PROVIDED AND/OR DISCOVERED BY: Derek Soeder, eEye Digital Security.
The vendor also credits Zero Day Initiative.
ORIGINAL ADVISORY: Adobe: http://www.adobe.com/support/security/bulletins/apsb06-19.html
eEye Digital Security: http://research.eeye.com/html/advisories/published/AD20061205.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200612-0480",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "jrun",
"scope": "eq",
"trust": 2.4,
"vendor": "adobe",
"version": "4.0"
},
{
"model": "coldfusion",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "7.0.2"
},
{
"model": "coldfusion",
"scope": "gte",
"trust": 1.0,
"vendor": "adobe",
"version": "7.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "adobe",
"version": null
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "mx mx 7 to 7.0.2"
},
{
"model": "iis",
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "7.0"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "7.0.1"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "7.0.2"
},
{
"model": "coldfusion mx",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.02"
},
{
"model": "coldfusion mx",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.01"
},
{
"model": "coldfusion mx",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.00"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:adobe:coldfusion",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:adobe:jrun",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:microsoft:iis",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Inge Henriksen is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "21978"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
}
],
"trust": 0.9
},
"cve": "CVE-2006-5858",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2006-5858",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2006-5858",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#448569",
"trust": 0.8,
"value": "4.62"
},
{
"author": "NVD",
"id": "CVE-2006-5858",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200612-697",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file. Adobe Download Manager contains a buffer overflow. This vulnerability may allow a remote, unauthenticated attacker to run arbitrary code with the privileges of the affected user or cause a denial-of-service condition. Adobe ColdFusion is prone to an information-disclosure vulnerability. \nSuccessfully exploiting this issue allows remote attackers to gain access to the contents of arbitrary files that are not interpreted by ColdFusion. This includes the source of scripting files not handled by ColdFusion, configuration files, log files, and other data files. Information harvested may aid attackers in further attacks. \nAdobe ColdFusion MX7, 7.0.1 and 7.0.2 are vulnerable. \n\n----------------------------------------------------------------------\n\nSecunia is proud to announce the availability of the Secunia Software\nInspector. \n\nThe Secunia Software Inspector is a free service that detects insecure\nversions of software that you may have installed in your system. When\ninsecure versions are detected, the Secunia Software Inspector also\nprovides thorough guidelines for updating the software to the latest\nsecure version from the vendor. \".cfm\". Other versions may also be affected. \n\nSOLUTION:\nApply hotfix (See vendor\u0027s advisory for details). Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability\n\niDefense Security Advisory 01.09.07\nhttp://labs.idefense.com/intelligence/vulnerabilities/\nJan 09, 2007\n\nI. BACKGROUND\n\nAdobe Macromedia ColdFusion is an application server and development\nframework for websites. More information is available at the following\nURL. \n\nhttp://www.adobe.com/products/coldfusion/\n\nII. DESCRIPTION\n\nRemote exploitation of an input validation vulnerability in Adobe Systems\nInc.\u0027s Macromedia ColdFusion MX 7 may allow an attacker to view file\ncontents on the server. \n\nThe vulnerability specifically exists in that URL encoded filenames will\nbe decoded by the IIS process and then again by the ColdFusion process. By\nsupplying a URL containing a double encoded null byte and an extension\nhandled by ColdFusion, such as \u0027.cfm\u0027, it is possible to view the contents\nof any file which is not interpreted by ColdFusion. \n\nIII. Although this\nvulnerability does not in itself allow execution of code on the server, it\nmay allow an attacker to discover sensitive information such as passwords\nor to discover vulnerabilities in other scripts on the system or\npotentially bypass some security restrictions. \n\nIV. DETECTION\n\niDefense has confirmed this vulnerability exists in Adobe Macromedia\nColdFusion MX 7.0.2, with all available fixes, running on Microsoft IIS\nvulnerable. \n\nV. WORKAROUND\n\niDefense is unaware of any effective workarounds for this vulnerability. \n\nVI. VENDOR RESPONSE\n\nAdobe has released a patch for this issue. For more information consult\ntheir advisory at the link below. \n\nhttp://www.adobe.com/support/security/bulletins/apsb07-02.html\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2006-5858 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n11/08/2006 Initial vendor notification\n11/09/2006 Initial vendor response\n01/09/2007 Coordinated public disclosure\n\nIX. CREDIT\n\nThis vulnerability was reported to iDefense by Inge Henriksen. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2006 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert electronically. \nIt may not be edited in any way without the express written consent of\niDefense. If you wish to reprint the whole or any part of this alert in\nany other medium other than electronically, please e-mail\ncustomerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate at\nthe time of publishing based on currently available information. Use of\nthe information constitutes acceptance for use in an AS IS condition. \nThere are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct, indirect,\nor consequential loss or damage arising from use of, or reliance on, this\ninformation. \n\n----------------------------------------------------------------------\n\nTo improve our services to our customers, we have made a number of\nadditions to the Secunia Advisories and have started translating the\nadvisories to German. \n\nThe improvements will help our customers to get a better\nunderstanding of how we reached our conclusions, how it was rated,\nour thoughts on exploitation, attack vectors, and scenarios. \n\nThis includes:\n* Reason for rating\n* Extended description\n* Extended solution\n* Exploit code or links to exploit code\n* Deep links\n\nRead the full description:\nhttp://corporate.secunia.com/products/48/?r=l\n\nContact Secunia Sales for more information:\nhttp://corporate.secunia.com/how_to_buy/15/?r=l\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe Download Manager AOM Buffer Overflow Vulnerability\n\nSECUNIA ADVISORY ID:\nSA23233\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/23233/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nAdobe Download Manager 1.x\nhttp://secunia.com/product/7045/\nAdobe Download Manager 2.x\nhttp://secunia.com/product/12814/\n\nDESCRIPTION:\nA vulnerability has been reported in Adobe Download Manager, which\ncan be exploited by malicious people to compromise a user\u0027s system. \n\nThe vulnerability is caused due to a boundary error when handling\nsection names in the \"dm.ini\" file as created by Adobe Download\nManager when processing AOM files. This can be exploited to cause a\nstack-based buffer overflow via a specially crafted AOM or \"dm.ini\"\nfile. \n\nSuccessful exploitation allows execution of arbitrary code when a\nuser e.g. visits a malicious website. \n\nSOLUTION:\nUpdate to version 2.2. \n\nPROVIDED AND/OR DISCOVERED BY:\nDerek Soeder, eEye Digital Security. \n\nThe vendor also credits Zero Day Initiative. \n\nORIGINAL ADVISORY:\nAdobe:\nhttp://www.adobe.com/support/security/bulletins/apsb06-19.html\n\neEye Digital Security:\nhttp://research.eeye.com/html/advisories/published/AD20061205.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-5858"
},
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-5858",
"trust": 2.8
},
{
"db": "BID",
"id": "21978",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "23668",
"trust": 1.7
},
{
"db": "CERT/CC",
"id": "VU#448569",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1017490",
"trust": 1.6
},
{
"db": "VUPEN",
"id": "ADV-2007-0116",
"trust": 1.6
},
{
"db": "OSVDB",
"id": "32123",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "23233",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "53496",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "53585",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "52797",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"id": "VAR-200612-0480",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-11-23T21:57:24.851000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB07-02",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.iis.net/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.0
},
{
"problemtype": "CWE-20",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"trust": 1.7,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/23668"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
},
{
"trust": 1.6,
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"trust": 1.6,
"url": "http://securitytracker.com/id?1017490"
},
{
"trust": 1.6,
"url": "http://osvdb.org/32123"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/21978"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/23233/"
},
{
"trust": 0.9,
"url": "http://research.eeye.com/html/advisories/published/ad20061205.html"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb06-19.html "
},
{
"trust": 0.8,
"url": "http://www.adobe.com/products/acrobat/acrrmanager.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5858"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-5858"
},
{
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/448569"
},
{
"trust": 0.4,
"url": "http://www.adobe.com/products/coldfusion/"
},
{
"trust": 0.3,
"url": "/archive/1/456484"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/software_inspector/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/23668/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4984/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-5858"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/7045/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/12814/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/products/48/?r=l"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/15/?r=l"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb06-19.html"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-12-07T00:00:00",
"db": "CERT/CC",
"id": "VU#448569"
},
{
"date": "2007-01-09T00:00:00",
"db": "BID",
"id": "21978"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"date": "2007-01-10T18:19:08",
"db": "PACKETSTORM",
"id": "53496"
},
{
"date": "2007-01-13T23:25:20",
"db": "PACKETSTORM",
"id": "53585"
},
{
"date": "2006-12-07T06:24:29",
"db": "PACKETSTORM",
"id": "52797"
},
{
"date": "2006-12-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"date": "2006-12-31T05:00:00",
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-12-07T00:00:00",
"db": "CERT/CC",
"id": "VU#448569"
},
{
"date": "2007-01-10T20:51:00",
"db": "BID",
"id": "21978"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"date": "2020-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"date": "2024-11-21T00:20:50.727000",
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe Download Manager buffer overflow",
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.