FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-3195

This CVE name corresponds to:

Entered	Topic
2008-09-14	twiki -- Arbitrary code execution in session files

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-3195 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-3195
Phase	Assigned(20080716)

Description

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.

References

Source	Reference
MILW0RM	6269
CONFIRM	http://twiki.org/cgi-bin/view/Codev/TWikiRelease04x02x03#4_2_3_Bugfix_Highlights
CONFIRM	http://www.kb.cert.org/vuls/id/RGII-7JEQ7L
CONFIRM	http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195
CERT-VN	VU#362012
VUPEN	ADV-2008-2586
SECUNIA	31849
SECUNIA	31964
SREASON	4265
XF	twiki-configure-image-command-execution(45183)
XF	twiki-configure-directory-traversal(45182)