CVE-2006-6979

{"id": "CVE-2006-6979", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-02-08T18:28:00.000", "references": [{"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901", "source": "cve@mitre.org"}, {"url": "http://bugs.kde.org/show_bug.cgi?id=138499", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/23984", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/24159", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/24510", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/22568", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/0613", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."}, {"lang": "es", "value": "Los manejadores de ruby en el componente Magnatune en Amarok, no cita apropiadamente el texto en ciertos contextos, probablemente incluyendo la construcci\u00f3n de una l\u00ednea de comando unzip, lo que permite a atacantes ejecutar comandos arbitrario por medio de metacaracteres de shell."}], "lastModified": "2011-06-16T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amarok:amarok:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E570741F-43B4-4D13-A84E-8DE0E59436A4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}