CVE-2007-4962

Directory traversal vulnerability in WinImage 8.10 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged for code execution by writing to a Startup folder.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://osvdb.org/40550
http://secunia.com/advisories/26832	Vendor Advisory
http://securityreason.com/securityalert/3140
http://www.securityfocus.com/archive/1/479695/100/0/threaded
http://www.securityfocus.com/bid/25687	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/36663
http://osvdb.org/40550
http://secunia.com/advisories/26832	Vendor Advisory
http://securityreason.com/securityalert/3140
http://www.securityfocus.com/archive/1/479695/100/0/threaded
http://www.securityfocus.com/bid/25687	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/36663

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:winimage:winimage:8.0:::::::*
	cpe:2.3:a:winimage:winimage:8.10:::::::*

History

21 Nov 2024, 00:36

Type	Values Removed	Values Added
References	~~() http://osvdb.org/40550 -~~	() http://osvdb.org/40550 -
References	~~() http://secunia.com/advisories/26832 - Vendor Advisory~~	() http://secunia.com/advisories/26832 - Vendor Advisory
References	~~() http://securityreason.com/securityalert/3140 -~~	() http://securityreason.com/securityalert/3140 -
References	~~() http://www.securityfocus.com/archive/1/479695/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/479695/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/25687 - Exploit~~	() http://www.securityfocus.com/bid/25687 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/36663 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/36663 -

Information

Published : 2007-09-18 22:17

Updated : 2024-11-21 00:36

NVD link : CVE-2007-4962

Mitre link : CVE-2007-4962

CVE.ORG link : CVE-2007-4962

JSON object : View

Products Affected

winimage

winimage

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2007-4962", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-09-18T22:17:00.000", "references": [{"url": "http://osvdb.org/40550", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/26832", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3140", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/479695/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25687", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36663", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/40550", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/26832", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/securityalert/3140", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/479695/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/25687", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36663", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in WinImage 8.10 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged for code execution by writing to a Startup folder."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en WinImage 8.10 y versiones anteriores permite a atacantes remotos con la complicidad del usuario crear o sbore-escribir ficheros de su elecci\u00f3n mediante un .. (punto punto) en un nombre de fichero de (1) .IMG or (2) .ISO.\r\nNOTA. Esto puede ser utilizado para la ejecuci\u00f3n de c\u00f3digo al escribir en una carpeta de inicio (Startup)."}], "lastModified": "2024-11-21T00:36:49.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:winimage:winimage:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98C56540-83AE-47A4-B375-69972B19BFF7"}, {"criteria": "cpe:2.3:a:winimage:winimage:8.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D818847-9AE7-40DC-AE0D-1DAD5EF81435"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}