CVE-2007-0159
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
6.5 Medium
AI Score
Confidence
Low
0.024 Low
EPSS
Percentile
90.0%
Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers (possibly only update.maxmind.com) to overwrite arbitrary files via a … (dot dot) in the database filename, which is returned by a request to app/update_getfilename.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| geoip:geoip | geoip | eq | 1.4.0 |
References
arctic.org/~dean/patches/GeoIP-1.4.0-update-vulnerability.patch
osvdb.org/31618
secunia.com/advisories/23880
secunia.com/advisories/23906
www.mandriva.com/security/advisories?name=MDKSA-2007:004
www.securityfocus.com/bid/21959
www.ubuntu.com/usn/usn-412-1
www.vupen.com/english/advisories/2007/0117
www.vupen.com/english/advisories/2007/0118
exchange.xforce.ibmcloud.com/vulnerabilities/31383
Related
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
6.5 Medium
AI Score
Confidence
Low
0.024 Low
EPSS
Percentile
90.0%