FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-5705

This CVE name corresponds to:

Entered	Topic
2009-01-11	verlihub -- insecure temporary file usage and arbitrary command execution

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-5705 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-5705
Phase	Assigned(20081222)

Description

The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier, when user triggers are enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in an argument.

References

Source	Reference
MILW0RM	7183
MLIST	[oss-security] 20081216 CVE id request: verlihub
MISC	http://bugs.debian.org/506530
BID	32420
SREASON	4800
XF	verlihub-trigger-command-execution(46801)