CVE-2002-0286
CVSS7.5
发布时间 :2002-05-31 00:00:00
修订时间 :2016-10-17 22:18:22
NMCOS    

[原文]The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to add_user.php, which causes GetPassword to produce and compare a blank password for the non-existent user.


[CNNVD]Sitenews未认证用户添加漏洞(CNNVD-200205-143)

        SiteNews 0.10和0.11版本的function.php中GetPassword函数存在漏洞。远程攻击者通过给add_user.php的空密码提供一个不存在的用户名和MD5校验从而提升特权且添加用户。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:sitenews:sitenews:0.04_beta
cpe:/a:sitenews:sitenews:0.03_beta
cpe:/a:sitenews:sitenews:0.09_beta
cpe:/a:sitenews:sitenews:0.06_beta
cpe:/a:sitenews:sitenews:0.10_beta
cpe:/a:sitenews:sitenews:0.02_beta
cpe:/a:sitenews:sitenews:0.01_beta
cpe:/a:sitenews:sitenews:0.05_beta
cpe:/a:sitenews:sitenews:0.07_beta
cpe:/a:sitenews:sitenews:0.11_beta
cpe:/a:sitenews:sitenews:0.08_beta

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0286
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0286
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200205-143
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=101388393808699&w=2
(UNKNOWN)  BUGTRAQ  20020216 SiteNews remote add user exploit
http://www.securityfocus.com/bid/4046
(UNKNOWN)  BID  4046
http://xforce.iss.net/xforce/xfdb/8181
(UNKNOWN)  XF  sitenews-getpassword-add-users(8181)

- 漏洞信息

Sitenews未认证用户添加漏洞
高危 设计错误
2002-05-31 00:00:00 2005-10-20 00:00:00
远程  
        SiteNews 0.10和0.11版本的function.php中GetPassword函数存在漏洞。远程攻击者通过给add_user.php的空密码提供一个不存在的用户名和MD5校验从而提升特权且添加用户。

- 公告与补丁

        This issue has been addressed in Sitenews 0.12 beta.
        Sitenews Sitenews 0.1 beta
        
        Sitenews Sitenews 0.10 beta
        
        Sitenews Sitenews 0.11 beta
        
        Sitenews Sitenews 0.2 beta
        
        Sitenews Sitenews 0.3 beta
        
        Sitenews Sitenews 0.4 beta
        
        Sitenews Sitenews 0.5 beta
        
        Sitenews Sitenews 0.6 beta
        
        Sitenews Sitenews 0.7 beta
        
        Sitenews Sitenews 0.8 beta
        
        Sitenews Sitenews 0.9 beta
        

- 漏洞信息

12672
SiteNews add_user.php Blank User MD5 Password Match Privilege Escalation
Remote / Network Access

- 漏洞描述

Unknown or Incomplete

- 时间线

2002-02-10 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Sitenews Unauthorized User Addition Vulnerability
Design Error 4046
Yes No
2002-02-07 12:00:00 2009-07-11 09:56:00
Discovery of this issue is credited to Ulf Härnhammar <metaur@prontomail.com>.

- 受影响的程序版本

Sitenews Sitenews 0.11 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.10 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.9 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.8 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.7 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.6 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.5 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.4 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.3 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.2 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.1 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17
Sitenews Sitenews 0.12 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17

- 不受影响的程序版本

Sitenews Sitenews 0.12 beta
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.18
- Apache Software Foundation Apache 1.3.17
- Apache Software Foundation Apache 1.3.17

- 漏洞讨论

Sitenews is a multi-user news management script written in PHP. It will run on most Unix and Linux variants, in addition to Microsoft Windows NT/2000 operating systems.

A security vulnerability exists which may allow a remote attacker to add arbitrary users to the user database of a Sitenews website.

A remote attacker who successfully exploits this issue will be again to gain unauthorized access to news management facilities.

- 漏洞利用

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

This issue has been addressed in Sitenews 0.12 beta.


Sitenews Sitenews 0.1 beta

Sitenews Sitenews 0.10 beta

Sitenews Sitenews 0.11 beta

Sitenews Sitenews 0.2 beta

Sitenews Sitenews 0.3 beta

Sitenews Sitenews 0.4 beta

Sitenews Sitenews 0.5 beta

Sitenews Sitenews 0.6 beta

Sitenews Sitenews 0.7 beta

Sitenews Sitenews 0.8 beta

Sitenews Sitenews 0.9 beta

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站