SB2012081202 - Multiple vulnerabilities in Resin

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012081202

SB2012081202 - Multiple vulnerabilities in Resin

Published: August 12, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012081202
Severity
Medium
Patch available
NO
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-2965)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.


2) Input validation error (CVE-ID: CVE-2012-2966)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.


3) Input validation error (CVE-ID: CVE-2012-2967)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.


4) Path traversal (CVE-ID: CVE-2012-2968)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in Caucho Quercus, as distributed in Resin before 4.0.29,. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to create files in arbitrary directories via a . (dot dot) in a pathname within an HTTP request.


5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-2969)

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References