6.4

CVE-2005-4699

Exploit
Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive information via "--" style options in the q_Host parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kimihia ≫ Tellme Version <= 1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.86% 0.765
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0107.html
Patch
Vendor Advisory
Exploit
Broken Link
http://exploitlabs.com/files/advisories/EXPL-A-2005-015-tellme.txt
Patch
Vendor Advisory
Exploit
http://kimihia.org.nz/projects/tellme/files/tellme-1.2-1.3.diff
Product
http://secunia.com/advisories/17078
Patch
Vendor Advisory
Broken Link
http://www.osvdb.org/19871
Patch
Exploit
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/22522
Third Party Advisory
VDB Entry