CVE-2008-0932 : diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attack

Products affected by CVE-2008-0932

The Sword Project » Diatheke Front End
Versions up to, including, (<=) 1.5.9
cpe:2.3:a:the_sword_project:diatheke_front_end:*:*:*:*:*:*:*:*
Matching versions
When used together with: Debian » Debian Linux » Version: 3.1
When used together with: Debian » Debian Linux » Version: 3.1 Alpha Edition
When used together with: Debian » Debian Linux » Version: 3.1 Amd64 Edition
When used together with: Debian » Debian Linux » Version: 3.1 ARM Edition
When used together with: Debian » Debian Linux » Version: 3.1 Hppa Edition
When used together with: Debian » Debian Linux » Version: 3.1 Ia-32 Edition
When used together with: Debian » Debian Linux » Version: 3.1 Ia-64 Edition
When used together with: Debian » Debian Linux » Version: 3.1 M68k Edition
When used together with: Debian » Debian Linux » Version: 3.1 Mips Edition
When used together with: Debian » Debian Linux » Version: 3.1 Mipsel Edition
When used together with: Debian » Debian Linux » Version: 3.1 PPC Edition
When used together with: Debian » Debian Linux » Version: 3.1 S-390 Edition
When used together with: Debian » Debian Linux » Version: 3.1 Sparc Edition
When used together with: Debian » Debian Linux » Version: 3.1 Update R1
When used together with: Debian » Debian Linux » Version: 4.0
When used together with: Debian » Debian Linux » Version: 4.0 Alpha Edition
When used together with: Debian » Debian Linux » Version: 4.0 Amd64 Edition
When used together with: Debian » Debian Linux » Version: 4.0 ARM Edition
When used together with: Debian » Debian Linux » Version: 4.0 Hppa Edition
When used together with: Debian » Debian Linux » Version: 4.0 Ia-32 Edition
When used together with: Debian » Debian Linux » Version: 4.0 Ia-64 Edition
When used together with: Debian » Debian Linux » Version: 4.0 M68k Edition
When used together with: Debian » Debian Linux » Version: 4.0 Mips Edition
When used together with: Debian » Debian Linux » Version: 4.0 Mipsel Edition
When used together with: Debian » Debian Linux » Version: 4.0 Powerpc Edition
When used together with: Debian » Debian Linux » Version: 4.0 S-390 Edition
When used together with: Debian » Debian Linux » Version: 4.0 Sparc Edition
When used together with: Redhat » Fedora » Version: 7
When used together with: Redhat » Fedora » Version: 8
The Sword Project » Sword
Versions up to, including, (<=) 1.5.9
cpe:2.3:a:the_sword_project:sword:*:*:*:*:*:*:*:*
Matching versions
When used together with: Debian » Debian Linux » Version: 3.1
When used together with: Debian » Debian Linux » Version: 3.1 Alpha Edition
When used together with: Debian » Debian Linux » Version: 3.1 Amd64 Edition
When used together with: Debian » Debian Linux » Version: 3.1 ARM Edition
When used together with: Debian » Debian Linux » Version: 3.1 Hppa Edition
When used together with: Debian » Debian Linux » Version: 3.1 Ia-32 Edition
When used together with: Debian » Debian Linux » Version: 3.1 Ia-64 Edition
When used together with: Debian » Debian Linux » Version: 3.1 M68k Edition
When used together with: Debian » Debian Linux » Version: 3.1 Mips Edition
When used together with: Debian » Debian Linux » Version: 3.1 Mipsel Edition
When used together with: Debian » Debian Linux » Version: 3.1 PPC Edition
When used together with: Debian » Debian Linux » Version: 3.1 S-390 Edition
When used together with: Debian » Debian Linux » Version: 3.1 Sparc Edition
When used together with: Debian » Debian Linux » Version: 3.1 Update R1
When used together with: Debian » Debian Linux » Version: 4.0
When used together with: Debian » Debian Linux » Version: 4.0 Alpha Edition
When used together with: Debian » Debian Linux » Version: 4.0 Amd64 Edition
When used together with: Debian » Debian Linux » Version: 4.0 ARM Edition
When used together with: Debian » Debian Linux » Version: 4.0 Hppa Edition
When used together with: Debian » Debian Linux » Version: 4.0 Ia-32 Edition
When used together with: Debian » Debian Linux » Version: 4.0 Ia-64 Edition
When used together with: Debian » Debian Linux » Version: 4.0 M68k Edition
When used together with: Debian » Debian Linux » Version: 4.0 Mips Edition
When used together with: Debian » Debian Linux » Version: 4.0 Mipsel Edition
When used together with: Debian » Debian Linux » Version: 4.0 Powerpc Edition
When used together with: Debian » Debian Linux » Version: 4.0 S-390 Edition
When used together with: Debian » Debian Linux » Version: 4.0 Sparc Edition
When used together with: Redhat » Fedora » Version: 7
When used together with: Redhat » Fedora » Version: 8

Exploit prediction scoring system (EPSS) score for CVE-2008-0932

EPSS FAQ

1.80%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-0932

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2008-0932

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-0932

http://www.securityfocus.com/bid/27874
http://www.vupen.com/english/advisories/2008/0670/references

Site en construction
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00769.html

[SECURITY] Fedora 7 Update: sword-1.5.10-2.fc7
http://security.gentoo.org/glsa/glsa-200803-06.xml

SWORD: Shell command injection (GLSA 200803-06) — Gentoo security
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449

#466449 - diatheke: Diatheke allows arbitrary command execution using the range parameter - Debian Bug report logs
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00806.html

[SECURITY] Fedora 8 Update: sword-1.5.10-2.fc8
https://bugzilla.redhat.com/show_bug.cgi?id=433723

433723 – (CVE-2008-0932) CVE-2008-0932 sword: diatheke.pl command injection
http://www.debian.org/security/2008/dsa-1508

[SECURITY] [DSA 1508-1] New diatheke packages fix arbirary shell command execution
http://www.securityfocus.com/bid/27987

Vulnerability Details : CVE-2008-0932

Products affected by CVE-2008-0932

Exploit prediction scoring system (EPSS) score for CVE-2008-0932

CVSS scores for CVE-2008-0932

CWE ids for CVE-2008-0932

References for CVE-2008-0932