Risk | Medium |
Patch available | NO |
Number of vulnerabilities | 5 |
CVE-ID | CVE-2012-2965 CVE-2012-2966 CVE-2012-2967 CVE-2012-2968 CVE-2012-2969 |
CWE-ID | CWE-20 CWE-22 CWE-264 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Resin Other software / Other software solutions |
Vendor | Caucho Technology |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
EUVDB-ID: #VU43740
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2012-2965
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.
MitigationInstall update from vendor's website.
Vulnerable software versionsResin: 2.0.0 - 4.0.27
External linkshttp://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU43741
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2012-2966
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.
MitigationInstall update from vendor's website.
Vulnerable software versionsResin: 2.0.0 - 4.0.27
External linkshttp://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU43742
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2012-2967
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.
MitigationInstall update from vendor's website.
Vulnerable software versionsResin: 2.0.0 - 4.0.27
External linkshttp://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU43743
Risk: Medium
CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2012-2968
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in Caucho Quercus, as distributed in Resin before 4.0.29,. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to create files in arbitrary directories via a . (dot dot) in a pathname within an HTTP request.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsResin: 2.0.0 - 4.0.27
External linkshttp://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU43744
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2012-2969
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.
MitigationInstall update from vendor's website.
Vulnerable software versionsResin: 2.0.0 - 4.0.27
External linkshttp://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.