Soluciones para vulnerabilidades

La exploración de vulnerabilidades periódica de Nimsoft Cloud Monitor busca la vulnerabilidad siguiente. Para ver las soluciones añadidas más recientemente que Nimsoft Cloud Monitor explora, visite Soluciones para vulnerabilidades.

Categoría: CGI abuses Factor de riesgo: Medium Añadido: 18 mar 2010
Synopsis:

An application hosted on the remote web server has a directory traversal vulnerability.

Description:

The version of OSSIM hosted on the remote host has a directory traversal vulnerability. Input to the 'file' parameter of the
'ossim/repository/download.php' script is not properly sanitized.

A remote attacker could exploit this to download arbitrary files, subject to the privileges under which the web server operates.

This version of OSSIM likely has other vulnerabilities in its web interface, though Scanner has not checked for them.

See also:

http://www.nessus.org/u?4bd9f4c5 (CYBSEC advisory, PDF)
http://www.alienvault.com/docs/2.2.1_release_notes.txt

Solution:

Upgrade to OSSIM 2.2.1 or later.

Risk factor:

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)