CVE-2009-0753 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:P/I:N/A:N
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 91%

Vendor	Product	Version
mldonkey	mldonkey	2.8.4
mldonkey	mldonkey	2.8.7
mldonkey	mldonkey	2.9
mldonkey	mldonkey	2.9.0-r3
mldonkey	mldonkey	2.9.7

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

mldonkey

intrepid	Fixed 2.9.5-1ubuntu0.1 released
hardy	Fixed 2.9.2-2ubuntu0.1 released
gutsy	ignored
dapper	not-affected

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

http://savannah.nongnu.org/bugs/?25667

http://secunia.com/advisories/34008

http://secunia.com/advisories/34306

http://secunia.com/advisories/34345

http://secunia.com/advisories/34436

http://www.debian.org/security/2009/dsa-1739

http://www.gentoo.org/security/en/glsa/glsa-200903-36.xml

http://www.openwall.com/lists/oss-security/2009/02/23/1

http://www.securityfocus.com/bid/33865

https://www.exploit-db.com/exploits/8097

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00542.html

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00617.html

http://savannah.nongnu.org/bugs/?25667

http://secunia.com/advisories/34008

http://secunia.com/advisories/34306

http://secunia.com/advisories/34345

http://secunia.com/advisories/34436

http://www.debian.org/security/2009/dsa-1739

http://www.gentoo.org/security/en/glsa/glsa-200903-36.xml

http://www.openwall.com/lists/oss-security/2009/02/23/1

http://www.securityfocus.com/bid/33865

https://www.exploit-db.com/exploits/8097

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00542.html

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00617.html