FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-4025

This CVE name corresponds to:

Entered	Topic
2010-01-04	PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-4025 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-4025
Phase	Assigned(20091120)

Description

Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.

References

Source	Reference
MLIST	[oss-security] 20091123 CVE request: Argument injections in multiple PEAR packages
CONFIRM	http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/
CONFIRM	http://pear.php.net/advisory20091114-01.txt
CONFIRM	http://pear.php.net/package/Net_Traceroute/download/0.21.2
FEDORA	FEDORA-2009-11551
FEDORA	FEDORA-2009-11617
FEDORA	FEDORA-2009-12083
GENTOO	GLSA-200911-06
BID	37094
OSVDB	60515
SECUNIA	37497
SECUNIA	37503
VUPEN	ADV-2009-3321
XF	nettraceroute-traceroute-command-execution(54391)