Soluções para vulnerabilidades

O Exame Periódico de Vulnerabilidade do Nimsoft Cloud Monitor verifica a vulnerabilidade abaixo. Para ver as soluções para vulneralidades adicionadas mais recentemente que são examinadas pelo WatchMouse, acesse a visão geral das Soluções para vulnerabilidades

Categoria: CGI abuses Fator de risco: Medium Adicionado: 18 Mar 2010
Synopsis:

An application hosted on the remote web server has a directory traversal vulnerability.

Description:

The version of OSSIM hosted on the remote host has a directory traversal vulnerability. Input to the 'file' parameter of the
'ossim/repository/download.php' script is not properly sanitized.

A remote attacker could exploit this to download arbitrary files, subject to the privileges under which the web server operates.

This version of OSSIM likely has other vulnerabilities in its web interface, though Scanner has not checked for them.

See also:

http://www.nessus.org/u?4bd9f4c5 (CYBSEC advisory, PDF)
http://www.alienvault.com/docs/2.2.1_release_notes.txt

Solution:

Upgrade to OSSIM 2.2.1 or later.

Risk factor:

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)