CVE-2008-1117

EPSS 69.5%

Vexday Risk Score

50Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 69.5%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

14 mar 2008Publicada en NVD

10 may 2008Exploit Metasploit disponible

24 nov 2010PoC pública

Velocidad de armamento

984 díashasta el primer PoC

56 díashasta el módulo Metasploit

Recomendación: Planificar corrección próxima — ya existe PoC pública.

Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 3

exploitdbwww.exploit-db.com/exploits/16339no verificado cve_referencewww.exploit-db.com/exploits/4455no verificado cve_referencewww.exploit-db.com/exploits/5238no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://aluigi.altervista.org/adv/timbuto-adv.txt http://aluigi.org/poc/timbuto.zip http://secunia.com/advisories/29316 http://securityreason.com/securityalert/3741 https://www.exploit-db.com/exploits/4455 https://www.exploit-db.com/exploits/5238 http://www.coresecurity.com/?action=item&id=2166 http://www.securityfocus.com/archive/1/489360/100/0/threaded http://www.securityfocus.com/archive/1/489382/100/0/threaded http://www.securityfocus.com/archive/1/489414/100/0/threaded http://www.securityfocus.com/bid/28081 http://www.vupen.com/english/advisories/2008/0840