5

CVE-2002-1042

Exploit
Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netscape ≫ Enterprise Server Version 3.6
Sun ≫ Iplanet Web Server Version 4.1
Sun ≫ Iplanet Web Server Version 4.1 Update sp1
Sun ≫ Iplanet Web Server Version 4.1 Update sp1 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp10
Sun ≫ Iplanet Web Server Version 4.1 Update sp10 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp2
Sun ≫ Iplanet Web Server Version 4.1 Update sp2 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp3
Sun ≫ Iplanet Web Server Version 4.1 Update sp3 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp4
Sun ≫ Iplanet Web Server Version 4.1 Update sp4 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp5
Sun ≫ Iplanet Web Server Version 4.1 Update sp5 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp6
Sun ≫ Iplanet Web Server Version 4.1 Update sp6 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp7
Sun ≫ Iplanet Web Server Version 4.1 Update sp7 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp8
Sun ≫ Iplanet Web Server Version 4.1 Update sp8 Edition enterprise
Sun ≫ Iplanet Web Server Version 4.1 Update sp9
Sun ≫ Iplanet Web Server Version 4.1 Update sp9 Edition enterprise
Sun ≫ One Application Server Version 6.0
Sun ≫ One Application Server Version 6.0 Update sp1
Sun ≫ One Application Server Version 6.0 Update sp2
Sun ≫ One Web Server Version 6.0 Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.85% 0.888
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://archives.neohapsis.com/archives/bugtraq/2002-07/0085.html
http://www.iss.net/security_center/static/9517.php
Patch
Vendor Advisory
http://www.securityfocus.com/bid/5191
Patch
Vendor Advisory
Exploit