Interchange URL could allow an attacker to obtain information
| interchange-url-obtain-information (15670) |  Medium Risk |
Description:
Interchange could allow a remote attacker to obtain sensitive information. If the default "missing" special page is enabled, a remote attacker could send a specially-crafted URL request to obtain sensitive information.
Consequences:
Obtain Information
Remedy:
Upgrade to the latest version of Interchange (5.0.1 or later) available from the Interchange Web page. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest Interchange package (4.8.3.20020306-1.woody.2 or later), as listed in DSA-471-1. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Interchange Web site: Interchange Developers Resource.
- Interchange What's New Web page: Interchange 5.0.1 released 2004-03-29.
- BID-10005: Interchange Remote Information Disclosure Vulnerability
- BID-10007: Clam Anti-Virus ClamAV Arbitrary Command Execution Vulnerability
- BID-10008: MPlayer Remote HTTP Header Buffer Overflow Vulnerability
- BID-10009: Oracle Single Sign-On Login Page Authentication Credential Disclosure Vulnerability
- BID-1001: InterAccess TelnetD Server 4.0 Terminal Configuration Vulnerability
- BID-10010: LinBit Technologies LINBOX Officeserver Remote Authentication Bypass Vulnerability
- BID-10013: PHPKit Multiple HTML Injection Vulnerabilities
- BID-10017: JamesOff QuoteEngine Multiple Parameter Unspecified SQL Injection Vulnerability
- BID-10018: MadBMS Unspecified Login Vulnerability
- BID-10019: Cactusoft CactuShop SQL Injection Vulnerability
- BID-1002: Sambar Server Batch CGI Vulnerability
- BID-10020: CactuSoft CactuShop Cross-Site Scripting Vulnerability
- BID-10022: Roger Wilco Server UDP Datagram Handling Denial Of Service Vulnerability
- BID-10024: Roger Wilco Information Disclosure Vulnerability
- BID-10025: Roger Wilco Server Unauthorized Audio Stream Denial Of Service Vulnerability
- BID-10026: ADA IMGSVR Remote Directory Listing Vulnerability
- BID-10027: ADA IMGSVR Remote File Download Vulnerability
- BID-10028: OpenBSD ISAKMPD Zero Payload Length Denial Of Service Vulnerability
- BID-1003: FTPx FTP Explorer Weak Password Encryption Vulnerability
- BID-10033: HAHTsite Scenario Server Project File Name Buffer Overrun Vulnerability
- BID-10036: Macromedia Dreamweaver Remote User Database Access Vulnerability
- BID-10037: SGI IRIX ftpd Multiple Denial Of Service Vulnerabilities
- CVE-2004-0374: Interchange before 5.0.1 allows remote attackers to expose the content of arbitrary variables and read or modify sensitive SQL information via an HTTP request ending with the __SQLUSER__ string.
- DSA-471: interchange -- missing input sanitising
- SA11234: Interchange Arbitrary Variable Content Disclosure
Platforms Affected:
- Debian Debian Linux 2.3
- Debian Debian Linux 3.0
- Icdevgroup Interchange prior to 5.0.1
Reported:
Mar 30, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net