|
|
Info |
Last Modified |
| 10 months ago |
|
|
|
|
Description |
Guppy contains a flaw that may allow a remote denial of service. The issue is caused by the improper sanitization of the 'pg' variable in dwnld.php before being used to write a counter value to '.dtb' files. An attacker can overwrite any file with permissions set to 666 via null injection resulting in a loss of availability for the service.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Availability
Exploit:
Exploit Available
OSVDB:
Web Related
|
|
Technical |
This vulnerability is only present when the magic_quotes_gpc PHP option is 'off'.
|
|
Solution |
Upgrade to version 4.5.12 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
GuppY
 |
4.5.4 |
2.4 |
2.4 p1 |
2.4 p3 |
2.4 p4 |
4.5 |
4.5.3 |
4.5.3 a |
4.5.9 |
4.5.10 |
4.5.11 |
|
|
|
|
|
Credit |
- trueend5 - trueend5
 kapda ir - http://www.KAPDA.ir
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
