AlphaOne Technology Support Forums
Welcome, Guest. Please login or register.
December 03, 2008, 04:04:33 PM

Login with username, password and session length
Search:     Advanced search
1733 Posts in 827 Topics by 4765 Members
Latest Member: hunteryazmin
* Home Help Search Login Register
AlphaOne Technology Support Forums  |  IMPORTANT ANNOUNCEMENTS  |  Security Announcements  |  Topic: TWiki "rev" Parameter Remote Command Execution Vulnerability 0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] Go Down Print
Author Topic: TWiki "rev" Parameter Remote Command Execution Vulnerability  (Read 875 times)
TJ
Tech Team
Hero Member
********
Offline Offline

Posts: 136



View Profile
TWiki "rev" Parameter Remote Command Execution Vulnerability
« on: September 17, 2005, 10:30:30 AM »
* Technical Description *

A vulnerability was identified inTWiki, which may be exploited by remote attackers to execute arbitrary commands. This flaw is due to an input validation error in the "/cgi-bin/view/Main/TWikiUsers" script that does not properly filter a specially crafted "rev" parameter, which may be exploited by remote attackers to execute arbitrary shell commands.

 * Affected Products *

TWiki Production Release 02-Sep-2004
TWiki Production Release 01-Sep-2004
TWiki Production Release 01-Feb-2003
TWiki Production Release 01-Dec-2001
TWiki Production Release 01-Dec-2000

 * Solution *

Apply patches :
http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev

 * References *

http://www.frsirt.com/english/advisories/2005/1750
http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
Logged
Pages: [1] Go Up Print 
AlphaOne Technology Support Forums  |  IMPORTANT ANNOUNCEMENTS  |  Security Announcements  |  Topic: TWiki "rev" Parameter Remote Command Execution Vulnerability « previous next »
Jump to:  

Powered by MySQL Powered by PHP AlphaOne Technology Support Forums | Powered by SMF 1.0.7.
© 2001-2005, Lewis Media. All Rights Reserved. 		Valid XHTML 1.0! Valid CSS!