|
|
Info |
Last Modified |
| 8 months ago |
|
|
|
|
Description |
Sun Microsystems Solaris AnswerBook2 contains a flaw that may allow a malicious user to create an arbitrary account. The issue is triggered when a malicious user directly accesses the /cgi-bin/admin/admin script and passes it parameters to create a new user account. The new user account can then be used to access the admin functionality of AnswerBook2 resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Solution |
Upgrade to version 1.4.2 patched or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): disable the AnswerBook2 Documentation Server, the following commands can be run as the root user:
# /usr/lib/ab2/bin/ab2admin -o stop
# /usr/lib/ab2/bin/ab2admin -o autostart_no
|
|
Products |
|
AnswerBook2
 |
1.3 |
1.4 |
1.4.1 |
1.4.2 |
1.4.2 patched |
|
|
|
|
|
|
|
Credit |
- Lluis Mora - llmora
 s21sec.com - S21SEC
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
