ID OPENVAS:69040 Type openvas Reporter Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com Modified 2017-08-31T00:00:00
Description
The remote host is missing updates announced in
advisory GLSA 201101-04.
#
# OpenVAS Vulnerability Test
# $
# Description: Auto generated from Gentoo's XML based advisory
#
# Authors:
# Thomas Reinke <reinke@securityspace.com>
#
# Copyright:
# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com
# Text descriptions are largely excerpted from the referenced
# advisories, and are Copyright (c) the respective author(s)
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2,
# or at your option, GNU General Public License version 3,
# as published by the Free Software Foundation
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
#
include("revisions-lib.inc");
tag_insight = "A directory traversal vulnerability has been found in aria2.";
tag_solution = "All aria2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-misc/aria2-1.9.3'
http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201101-04
http://bugs.gentoo.org/show_bug.cgi?id=320975";
tag_summary = "The remote host is missing updates announced in
advisory GLSA 201101-04.";
if(description)
{
script_id(69040);
script_version("$Revision: 7029 $");
script_tag(name:"last_modification", value:"$Date: 2017-08-31 13:51:40 +0200 (Thu, 31 Aug 2017) $");
script_tag(name:"creation_date", value:"2011-03-09 05:54:11 +0100 (Wed, 09 Mar 2011)");
script_tag(name:"cvss_base", value:"4.3");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:P/A:N");
script_cve_id("CVE-2010-1512");
script_name("Gentoo Security Advisory GLSA 201101-04 (aria2)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com");
script_family("Gentoo Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/gentoo", "ssh/login/pkg");
script_tag(name : "insight" , value : tag_insight);
script_tag(name : "solution" , value : tag_solution);
script_tag(name : "summary" , value : tag_summary);
script_tag(name:"qod_type", value:"package");
script_tag(name:"solution_type", value:"VendorFix");
exit(0);
}
#
# The script code starts here
#
include("pkg-lib-gentoo.inc");
res = "";
report = "";
if ((res = ispkgvuln(pkg:"net-misc/aria2", unaffected: make_list("ge 1.9.3"), vulnerable: make_list("lt 1.9.3"))) != NULL) {
report += res;
}
if (report != "") {
security_message(data:report);
} else if (__pkg_match) {
exit(99); # Not vulnerable.
}
{"id": "OPENVAS:69040", "type": "openvas", "bulletinFamily": "scanner", "title": "Gentoo Security Advisory GLSA 201101-04 (aria2)", "description": "The remote host is missing updates announced in\nadvisory GLSA 201101-04.", "published": "2011-03-09T00:00:00", "modified": "2017-08-31T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=69040", "reporter": "Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com", "references": [], "cvelist": ["CVE-2010-1512"], "lastseen": "2017-09-04T14:20:01", "viewCount": 0, "enchantments": {"score": {"value": 6.4, "vector": "NONE", "modified": "2017-09-04T14:20:01", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-1512"]}, {"type": "gentoo", "idList": ["GLSA-201101-04"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:23877", "SECURITYVULNS:VULN:10845"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2047-1:CDBAA"]}, {"type": "nessus", "idList": ["FEDORA_2010-8905.NASL", "MANDRIVA_MDVSA-2010-106.NASL", "FEDORA_2010-8915.NASL", "SUSE_11_2_ARIA2-100604.NASL", "FEDORA_2010-8908.NASL", "GENTOO_GLSA-201101-04.NASL", "DEBIAN_DSA-2047.NASL", "SUSE_11_1_ARIA2-100902.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231067399", "OPENVAS:861972", "OPENVAS:1361412562310830950", "OPENVAS:1361412562310861961", "OPENVAS:1361412562310861972", "OPENVAS:861961", "OPENVAS:136141256231069040", "OPENVAS:1361412562310831056", "OPENVAS:67399", "OPENVAS:830950"]}, {"type": "fedora", "idList": ["FEDORA:6C6CA11118C", "FEDORA:A195D10F999", "FEDORA:253E211115A"]}], "modified": "2017-09-04T14:20:01", "rev": 2}, "vulnersScore": 6.4}, "pluginID": "69040", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A directory traversal vulnerability has been found in aria2.\";\ntag_solution = \"All aria2 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/aria2-1.9.3'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20201101-04\nhttp://bugs.gentoo.org/show_bug.cgi?id=320975\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 201101-04.\";\n\n \n \n\nif(description)\n{\n script_id(69040);\n script_version(\"$Revision: 7029 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-08-31 13:51:40 +0200 (Thu, 31 Aug 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-09 05:54:11 +0100 (Wed, 09 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Gentoo Security Advisory GLSA 201101-04 (aria2)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"net-misc/aria2\", unaffected: make_list(\"ge 1.9.3\"), vulnerable: make_list(\"lt 1.9.3\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "naslFamily": "Gentoo Local Security Checks"}
{"cve": [{"lastseen": "2020-12-09T19:34:38", "description": "Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.", "edition": 5, "cvss3": {}, "published": "2010-05-17T21:00:00", "title": "CVE-2010-1512", "type": "cve", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1512"], "modified": "2018-10-10T19:57:00", "cpe": ["cpe:/a:tatsuhiro_tsujikawa:aria2:1.6.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.6.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.5.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.9.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.3.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.2\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.12.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.5.0\\+2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.1.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.10.2\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.5.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.3.1\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.15.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.9.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.2.1\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.6.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.15.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.14.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.4.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.3.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.2.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.5", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.5.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.3.3", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.7.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.14.0\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.10.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.7.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.3.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.12.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.8.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.8.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.2.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.3", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.7.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.10.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.7.3", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.6.3", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.1\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.3.1\\+2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.1.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.8.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.10.0\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.15.1\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.0.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.5.0\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.5.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.6.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.4.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.1.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.5.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.2.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.15.3", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.16.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.1\\+2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.4.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.7.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.15.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.3.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.7.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.5.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.8.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.1\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.8.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.3.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.16.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.3.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.10.0", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.15.1\\+2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.6.0\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.9.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.13.0\\+1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.8.3", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.9.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.4.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.5.0b\\+20090716", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.0.1", "cpe:/a:tatsuhiro_tsujikawa:aria2:1.1.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.16.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.11.4", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.7.2", "cpe:/a:tatsuhiro_tsujikawa:aria2:0.2.1\\+2"], "id": "CVE-2010-1512", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1512", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.3:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.1\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.4:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.1\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.3.1\\+2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.3.1\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.16.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.14.0\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.5.0\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.0b\\+20090716:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.16.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.3:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.14.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.0\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.6.0\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.1\\+2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.12.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.10.2\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.1\\+2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.2\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.10.0\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.10.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.10.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.1\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.5.0\\+2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.5:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.2.1\\+1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.2:*:*:*:*:*:*:*", "cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.2.1\\+2:*:*:*:*:*:*:*"]}], "gentoo": [{"lastseen": "2016-09-06T19:46:58", "bulletinFamily": "unix", "cvelist": ["CVE-2010-1512"], "description": "### Background\n\naria2 is a download utility with resuming and segmented downloading with HTTP/HTTPS/FTP/BitTorrent support. \n\n### Description\n\nA directory traversal vulnerability was discovered in aria2. \n\n### Impact\n\nA remote attacker could entice a user to download from a specially crafted metalink file, resulting in the creation of arbitrary files. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll aria2 users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/aria2-1.9.3\"", "edition": 1, "modified": "2011-01-15T00:00:00", "published": "2011-01-15T00:00:00", "id": "GLSA-201101-04", "href": "https://security.gentoo.org/glsa/201101-04", "type": "gentoo", "title": "aria2: Directory traversal", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:34", "bulletinFamily": "software", "cvelist": ["CVE-2010-1512"], "description": "====================================================================== \r\n\r\n Secunia Research 13/05/2010\r\n\r\n - aria2 metalink "name" Directory Traversal Vulnerability -\r\n\r\n====================================================================== \r\nTable of Contents\r\n\r\nAffected Software....................................................1\r\nSeverity.............................................................2\r\nVendor's Description of Software.....................................3\r\nDescription of Vulnerability.........................................4\r\nSolution.............................................................5\r\nTime Table...........................................................6\r\nCredits..............................................................7\r\nReferences...........................................................8\r\nAbout Secunia........................................................9\r\nVerification........................................................10\r\n\r\n====================================================================== \r\n1) Affected Software \r\n\r\n* aria2 1.9.1 build2\r\n\r\nNOTE: Other versions may also be affected.\r\n\r\n====================================================================== \r\n2) Severity \r\n\r\nRating: Moderately critical\r\nImpact: System access\r\nWhere: Remote\r\n\r\n====================================================================== \r\n3) Vendor's Description of Software \r\n\r\n"aria2 is a lightweight multi-protocol & multi-source, cross platform\r\ndownload utility operated in command-line.".\r\n\r\nProduct Link:\r\nhttp://aria2.sourceforge.net/\r\n\r\n====================================================================== \r\n4) Description of Vulnerability\r\n\r\nSecunia Research has discovered a vulnerability in aria2, which can be\r\nexploited by malicious people to compromise a user's system.\r\n\r\nThe vulnerability is caused due to the application not properly\r\nsanitising the "name" attribute of the "file" element of metalink\r\nfiles before using it to download files. If a user is tricked into\r\ndownloading from a specially crafted metalink file, this can be\r\nexploited to download files to directories outside of the intended\r\ndownload directory via directory traversal attacks.\r\n\r\n====================================================================== \r\n5) Solution \r\n\r\nUpdate to version 1.9.3.\r\n\r\n====================================================================== \r\n6) Time Table \r\n\r\n30/04/2010 - Vendor notified.\r\n01/05/2010 - Vendor response.\r\n13/05/2010 - Public disclosure.\r\n\r\n====================================================================== \r\n7) Credits \r\n\r\nDiscovered by Stefan Cornelius, Secunia Research.\r\n\r\n====================================================================== \r\n8) References\r\n\r\nThe Common Vulnerabilities and Exposures (CVE) project has assigned \r\nCVE-2010-1512 for the vulnerability.\r\n\r\n====================================================================== \r\n9) About Secunia\r\n\r\nSecunia offers vulnerability management solutions to corporate\r\ncustomers with verified and reliable vulnerability intelligence\r\nrelevant to their specific system configuration:\r\n\r\nhttp://secunia.com/advisories/business_solutions/\r\n\r\nSecunia also provides a publicly accessible and comprehensive advisory\r\ndatabase as a service to the security community and private \r\nindividuals, who are interested in or concerned about IT-security.\r\n\r\nhttp://secunia.com/advisories/\r\n\r\nSecunia believes that it is important to support the community and to\r\ndo active vulnerability research in order to aid improving the \r\nsecurity and reliability of software in general:\r\n\r\nhttp://secunia.com/secunia_research/\r\n\r\nSecunia regularly hires new skilled team members. Check the URL below\r\nto see currently vacant positions:\r\n\r\nhttp://secunia.com/corporate/jobs/\r\n\r\nSecunia offers a FREE mailing list called Secunia Security Advisories:\r\n\r\nhttp://secunia.com/advisories/mailing_lists/\r\n\r\n====================================================================== \r\n10) Verification \r\n\r\nPlease verify this advisory by visiting the Secunia website:\r\nhttp://secunia.com/secunia_research/2010-71/\r\n\r\nComplete list of vulnerability reports published by Secunia Research:\r\nhttp://secunia.com/secunia_research/\r\n\r\n======================================================================", "edition": 1, "modified": "2010-05-17T00:00:00", "published": "2010-05-17T00:00:00", "id": "SECURITYVULNS:DOC:23877", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:23877", "title": "Secunia Research: aria2 metalink "name" Directory Traversal Vulnerability", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T11:09:36", "bulletinFamily": "software", "cvelist": ["CVE-2010-1512"], "description": "Directory traversal via metalink files.", "edition": 1, "modified": "2010-05-17T00:00:00", "published": "2010-05-17T00:00:00", "id": "SECURITYVULNS:VULN:10845", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:10845", "title": "aria2 directory traversal", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "debian": [{"lastseen": "2019-05-30T02:22:32", "bulletinFamily": "unix", "cvelist": ["CVE-2010-1512"], "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-2047-1 security@debian.org\nhttp://www.debian.org/security/ Thijs Kinkhorst\nMay 17, 2010 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : aria2\nVulnerability : insufficient input sanitising\nProblem type : local (remote)\nDebian-specific: no\nCVE Id : CVE-2010-1512\n\nA vulnerability was discovered in aria2, a download client. The "name"\nattribute of the "file" element of metalink files is not properly\nsanitised before using it to download files. If a user is tricked into\ndownloading from a specially crafted metalink file, this can be\nexploited to download files to directories outside of the intended\ndownload directory.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.14.0-1+lenny2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.9.3-1.\n\nWe recommend that you upgrade your aria2 package.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0.orig.tar.gz\n Size/MD5 checksum: 1343630 ae853240ee88e373a138021613e28cb1\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2.dsc\n Size/MD5 checksum: 1102 66f40f6d5908ed4caef208b258eb7617\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2.diff.gz\n Size/MD5 checksum: 21863 b2b9fec5b9a7eccd68f12ad29804cb9c\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_alpha.deb\n Size/MD5 checksum: 1272534 7783017240e59e1f8cd5bbb3bc4fd215\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_amd64.deb\n Size/MD5 checksum: 1092380 97206956e1358720fced7b3487727730\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_arm.deb\n Size/MD5 checksum: 1207446 af7d180b51ab9129e1241fb26a4b26a6\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_armel.deb\n Size/MD5 checksum: 1015996 b9c6fd9eb3029e738389666989f2d639\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_hppa.deb\n Size/MD5 checksum: 1261974 f656d07dec19c29d0f122083f753a624\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_i386.deb\n Size/MD5 checksum: 1062920 681a52c51e9492c494b9f4f75549881b\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_ia64.deb\n Size/MD5 checksum: 1481560 7a2c94d39885c2a8ca84d60339aa7c42\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_mips.deb\n Size/MD5 checksum: 1159630 2e26a8a5fb8e1d547ce11e6041dba0af\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_mipsel.deb\n Size/MD5 checksum: 1150846 6582fbd585d877b014acbec16d3d8f2f\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_powerpc.deb\n Size/MD5 checksum: 1104136 472f6ab9514e93c143ad770c39c77e4b\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_s390.deb\n Size/MD5 checksum: 1027002 c9291e6598c0b4f081749276e3eed79a\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/a/aria2/aria2_0.14.0-1+lenny2_sparc.deb\n Size/MD5 checksum: 1166750 b84d8c95931f2beb5c129f8d3bddaacc\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>\n", "edition": 2, "modified": "2010-05-17T18:28:47", "published": "2010-05-17T18:28:47", "id": "DEBIAN:DSA-2047-1:CDBAA", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2010/msg00088.html", "title": "[SECURITY] [DSA 2047-1] New aria2 packages fix directory traversal", "type": "debian", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "fedora": [{"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2010-1512"], "description": "aria2 is a download utility with resuming and segmented downloading. Supported protocols are HTTP/HTTPS/FTP/BitTorrent. It also supports Metalink version 3.0. Currently it has following features: - HTTP/HTTPS GET support - HTTP Proxy support - HTTP BASIC authentication support - HTTP Proxy authentication support - FTP support(active, passive mode) - FTP through HTTP proxy(GET command or tunneling) - Segmented download - Cookie support - It can run as a daemon process. - BitTorrent protocol support with fast extension. - Selective download in multi-file torrent - Metalink version 3.0 support(HTTP/FTP/BitTorrent). - Limiting download/upload speed ", "modified": "2010-05-22T01:52:23", "published": "2010-05-22T01:52:23", "id": "FEDORA:253E211115A", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 13 Update: aria2-1.9.3-1.fc13", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2010-1512"], "description": "aria2 is a download utility with resuming and segmented downloading. Supported protocols are HTTP/HTTPS/FTP/BitTorrent. It also supports Metalink version 3.0. Currently it has following features: - HTTP/HTTPS GET support - HTTP Proxy support - HTTP BASIC authentication support - HTTP Proxy authentication support - FTP support(active, passive mode) - FTP through HTTP proxy(GET command or tunneling) - Segmented download - Cookie support - It can run as a daemon process. - BitTorrent protocol support with fast extension. - Selective download in multi-file torrent - Metalink version 3.0 support(HTTP/FTP/BitTorrent). - Limiting download/upload speed ", "modified": "2010-05-22T01:52:33", "published": "2010-05-22T01:52:33", "id": "FEDORA:6C6CA11118C", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 12 Update: aria2-1.9.3-1.fc12", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2010-1512"], "description": "aria2 is a download utility with resuming and segmented downloading. Supported protocols are HTTP/HTTPS/FTP/BitTorrent. It also supports Metalink version 3.0. Currently it has following features: - HTTP/HTTPS GET support - HTTP Proxy support - HTTP BASIC authentication support - HTTP Proxy authentication support - FTP support(active, passive mode) - FTP through HTTP proxy(GET command or tunneling) - Segmented download - Cookie support - It can run as a daemon process. - BitTorrent protocol support with fast extension. - Selective download in multi-file torrent - Metalink version 3.0 support(HTTP/FTP/BitTorrent). - Limiting download/upload speed ", "modified": "2010-05-22T01:53:23", "published": "2010-05-22T01:53:23", "id": "FEDORA:A195D10F999", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 11 Update: aria2-1.9.3-1.fc11", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "nessus": [{"lastseen": "2021-01-12T10:08:54", "description": " - Thu May 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.3-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=2101\n\n - Fixes CVE-2010-1512. rhbz # 592014\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 23, "published": "2010-07-01T00:00:00", "title": "Fedora 13 : aria2-1.9.3-1.fc13 (2010-8905)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-07-01T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:13", "p-cpe:/a:fedoraproject:fedora:aria2"], "id": "FEDORA_2010-8905.NASL", "href": "https://www.tenable.com/plugins/nessus/47515", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-8905.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47515);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1512\");\n script_xref(name:\"FEDORA\", value:\"2010-8905\");\n\n script_name(english:\"Fedora 13 : aria2-1.9.3-1.fc13 (2010-8905)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Thu May 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.3-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=2101\n\n - Fixes CVE-2010-1512. rhbz # 592014\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=2101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=592012\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-May/041753.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b5d056d4\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected aria2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:13\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^13([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 13.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC13\", reference:\"aria2-1.9.3-1.fc13\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"aria2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-12T10:08:54", "description": " - Thu May 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.3-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=2101\n\n - Fixes CVE-2010-1512. rhbz # 592014\n\n - Sat Mar 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.0-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1990\n\n - Tue Feb 16 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.2-1\n\n - Several bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1860\n\n - Mon Dec 28 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.0-1\n\n - Many new features including XML RPC improvements and\n other bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1778\n\n - Mon Dec 7 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.7.1-1\n\n - Option --bt-prioritize-piece=tail will work again\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1721\n\n - Wed Nov 4 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.3-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1616\n\n - Sat Oct 10 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.2-1\n\n - Minor bug fixes and switch XZ compressed source\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1586\n\n - Thu Oct 8 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.1-1\n\n - Fixes memory leak in HTTP/FTP downloads and other\n minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1569\n\n - Wed Sep 23 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.0-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1544\n\n - Mon Aug 24 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.2-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1504\n\n - Sun Jul 26 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.1-2\n\n - update source\n\n - Sun Jul 26 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.1-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1494\n\n - Fixed the license tag\n\n - Sun Jul 26 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.0-1\n\n - Mostly minor bug fixes\n\n - WEB-Seeding support for multi-file torrent\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1476\n\n - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at\n lists.fedoraproject.org> - 1.3.1-2\n\n - Rebuilt for\n https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 24, "published": "2010-07-01T00:00:00", "title": "Fedora 11 : aria2-1.9.3-1.fc11 (2010-8915)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-07-01T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:11", "p-cpe:/a:fedoraproject:fedora:aria2"], "id": "FEDORA_2010-8915.NASL", "href": "https://www.tenable.com/plugins/nessus/47518", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-8915.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47518);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1512\");\n script_xref(name:\"FEDORA\", value:\"2010-8915\");\n\n script_name(english:\"Fedora 11 : aria2-1.9.3-1.fc11 (2010-8915)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Thu May 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.3-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=2101\n\n - Fixes CVE-2010-1512. rhbz # 592014\n\n - Sat Mar 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.0-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1990\n\n - Tue Feb 16 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.2-1\n\n - Several bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1860\n\n - Mon Dec 28 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.0-1\n\n - Many new features including XML RPC improvements and\n other bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1778\n\n - Mon Dec 7 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.7.1-1\n\n - Option --bt-prioritize-piece=tail will work again\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1721\n\n - Wed Nov 4 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.3-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1616\n\n - Sat Oct 10 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.2-1\n\n - Minor bug fixes and switch XZ compressed source\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1586\n\n - Thu Oct 8 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.1-1\n\n - Fixes memory leak in HTTP/FTP downloads and other\n minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1569\n\n - Wed Sep 23 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.6.0-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1544\n\n - Mon Aug 24 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.2-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1504\n\n - Sun Jul 26 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.1-2\n\n - update source\n\n - Sun Jul 26 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.1-1\n\n - Minor bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1494\n\n - Fixed the license tag\n\n - Sun Jul 26 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.5.0-1\n\n - Mostly minor bug fixes\n\n - WEB-Seeding support for multi-file torrent\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1476\n\n - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at\n lists.fedoraproject.org> - 1.3.1-2\n\n - Rebuilt for\n https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1476\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1494\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1544\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1569\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1616\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1778\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1990\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=2101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=592012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-May/041758.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2b7fdecd\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected aria2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/05/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^11([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 11.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC11\", reference:\"aria2-1.9.3-1.fc11\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"aria2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-12T10:08:54", "description": " - Thu May 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.3-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=2101\n\n - Fixes CVE-2010-1512. rhbz # 592014\n\n - Sat Mar 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.0-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1990\n\n - Tue Feb 16 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.2-1\n\n - Several bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1860\n\n - Mon Dec 28 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.0-1\n\n - Many new features including XML RPC improvements and\n other bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1778\n\n - Mon Dec 7 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.7.1-1\n\n - Option --bt-prioritize-piece=tail will work again\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1721\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 24, "published": "2010-07-01T00:00:00", "title": "Fedora 12 : aria2-1.9.3-1.fc12 (2010-8908)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-07-01T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:12", "p-cpe:/a:fedoraproject:fedora:aria2"], "id": "FEDORA_2010-8908.NASL", "href": "https://www.tenable.com/plugins/nessus/47516", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-8908.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47516);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1512\");\n script_xref(name:\"FEDORA\", value:\"2010-8908\");\n\n script_name(english:\"Fedora 12 : aria2-1.9.3-1.fc12 (2010-8908)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Thu May 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.3-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=2101\n\n - Fixes CVE-2010-1512. rhbz # 592014\n\n - Sat Mar 20 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.9.0-1\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1990\n\n - Tue Feb 16 2010 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.2-1\n\n - Several bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1860\n\n - Mon Dec 28 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.8.0-1\n\n - Many new features including XML RPC improvements and\n other bug fixes\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1778\n\n - Mon Dec 7 2009 Rahul Sundaram <sundaram at\n fedoraproject.org> - 1.7.1-1\n\n - Option --bt-prioritize-piece=tail will work again\n\n -\n http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE\n WS?revision=1721\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1778\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1990\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=2101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=592012\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b5c3a8c2\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected aria2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:12\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^12([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 12.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC12\", reference:\"aria2-1.9.3-1.fc12\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"aria2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-06T09:45:59", "description": "A vulnerability was discovered in aria2, a download client. The 'name'\nattribute of the 'file' element of metalink files is not properly\nsanitised before using it to download files. If a user is tricked into\ndownloading from a specially crafted metalink file, this can be\nexploited to download files to directories outside of the intended\ndownload directory.", "edition": 27, "published": "2010-05-18T00:00:00", "title": "Debian DSA-2047-1 : aria2 - insufficient input sanitising", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-05-18T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:aria2", "cpe:/o:debian:debian_linux:5.0"], "id": "DEBIAN_DSA-2047.NASL", "href": "https://www.tenable.com/plugins/nessus/46352", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2047. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(46352);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2010-1512\");\n script_bugtraq_id(40142);\n script_xref(name:\"DSA\", value:\"2047\");\n\n script_name(english:\"Debian DSA-2047-1 : aria2 - insufficient input sanitising\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability was discovered in aria2, a download client. The 'name'\nattribute of the 'file' element of metalink files is not properly\nsanitised before using it to download files. If a user is tricked into\ndownloading from a specially crafted metalink file, this can be\nexploited to download files to directories outside of the intended\ndownload directory.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2010/dsa-2047\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the aria2 package.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.14.0-1+lenny2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/05/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/05/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"aria2\", reference:\"0.14.0-1+lenny2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-07T11:52:41", "description": "A vulnerability was discovered in aria2 which allows remote attackers\nto create arbitrary files via directory traversal sequences in the\nname attribute of a file element in a metalink file (CVE-2010-1512).\n\nThis update fixes this issue.\n\nPackages for 2009.0 are provided as of the Extended Maintenance\nProgram. Please visit this link to learn more:\nhttp://store.mandriva.com/product_info.php?cPath=149&products_id=4\n90", "edition": 25, "published": "2010-05-25T00:00:00", "title": "Mandriva Linux Security Advisory : aria2 (MDVSA-2010:106)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-05-25T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:aria2", "cpe:/o:mandriva:linux:2009.0", "cpe:/o:mandriva:linux:2009.1", "cpe:/o:mandriva:linux:2010.0"], "id": "MANDRIVA_MDVSA-2010-106.NASL", "href": "https://www.tenable.com/plugins/nessus/46711", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2010:106. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(46711);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2010-1512\");\n script_bugtraq_id(40142);\n script_xref(name:\"MDVSA\", value:\"2010:106\");\n\n script_name(english:\"Mandriva Linux Security Advisory : aria2 (MDVSA-2010:106)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandriva Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability was discovered in aria2 which allows remote attackers\nto create arbitrary files via directory traversal sequences in the\nname attribute of a file element in a metalink file (CVE-2010-1512).\n\nThis update fixes this issue.\n\nPackages for 2009.0 are provided as of the Extended Maintenance\nProgram. Please visit this link to learn more:\nhttp://store.mandriva.com/product_info.php?cPath=149&products_id=4\n90\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected aria2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2010.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/05/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/05/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2009.0\", reference:\"aria2-0.15.3-0.20080918.3.2mdv2009.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2009.1\", reference:\"aria2-1.2.0-0.20090201.5.3mdv2009.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2010.0\", reference:\"aria2-1.6.2-1.4mdv2010.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-07T10:52:43", "description": "The remote host is affected by the vulnerability described in GLSA-201101-04\n(aria2: Directory traversal)\n\n A directory traversal vulnerability was discovered in aria2.\n \nImpact :\n\n A remote attacker could entice a user to download from a specially\n crafted metalink file, resulting in the creation of arbitrary files.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 21, "published": "2011-01-17T00:00:00", "title": "GLSA-201101-04 : aria2: Directory traversal", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2011-01-17T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:aria2", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201101-04.NASL", "href": "https://www.tenable.com/plugins/nessus/51534", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201101-04.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(51534);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2010-1512\");\n script_xref(name:\"GLSA\", value:\"201101-04\");\n\n script_name(english:\"GLSA-201101-04 : aria2: Directory traversal\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201101-04\n(aria2: Directory traversal)\n\n A directory traversal vulnerability was discovered in aria2.\n \nImpact :\n\n A remote attacker could entice a user to download from a specially\n crafted metalink file, resulting in the creation of arbitrary files.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201101-04\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All aria2 users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/aria2-1.9.3'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/01/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/01/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-misc/aria2\", unaffected:make_list(\"ge 1.9.3\"), vulnerable:make_list(\"lt 1.9.3\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"aria2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-17T14:05:37", "description": "This aria2 update to 1.9.3 fixes a metalink name Directory Traversal\nissue (CVE-2010-1512).\n\nThe version was also bumped from 1.8.2 to 1.9.3 to fix lots of bugs.", "edition": 24, "published": "2010-06-25T00:00:00", "title": "openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-06-25T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:aria2", "cpe:/o:novell:opensuse:11.2"], "id": "SUSE_11_2_ARIA2-100604.NASL", "href": "https://www.tenable.com/plugins/nessus/47134", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update aria2-2515.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47134);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-1512\");\n\n script_name(english:\"openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-1)\");\n script_summary(english:\"Check for the aria2-2515 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This aria2 update to 1.9.3 fixes a metalink name Directory Traversal\nissue (CVE-2010-1512).\n\nThe version was also bumped from 1.8.2 to 1.9.3 to fix lots of bugs.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=605937\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2010-06/msg00008.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected aria2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/06/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/06/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.2\", reference:\"aria2-1.9.3-0.1.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"aria2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-17T14:04:13", "description": "Specially crafted metalink files could trick aria2 into store\ndownloaded files outside of the intended directory (CVE-2010-1512).", "edition": 24, "published": "2010-09-14T00:00:00", "title": "openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-2)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "modified": "2010-09-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:aria2", "cpe:/o:novell:opensuse:11.1"], "id": "SUSE_11_1_ARIA2-100902.NASL", "href": "https://www.tenable.com/plugins/nessus/49212", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update aria2-3063.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(49212);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-1512\");\n\n script_name(english:\"openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-2)\");\n script_summary(english:\"Check for the aria2-3063 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Specially crafted metalink files could trick aria2 into store\ndownloaded files outside of the intended directory (CVE-2010-1512).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=605937\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2010-09/msg00015.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected aria2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:aria2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/09/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.1\", reference:\"aria2-0.16.0-1.20.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"aria2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "openvas": [{"lastseen": "2017-12-21T11:33:08", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "Check for the Version of aria2", "modified": "2017-12-21T00:00:00", "published": "2010-05-28T00:00:00", "id": "OPENVAS:861972", "href": "http://plugins.openvas.org/nasl.php?oid=861972", "type": "openvas", "title": "Fedora Update for aria2 FEDORA-2010-8915", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for aria2 FEDORA-2010-8915\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"aria2 is a download utility with resuming and segmented downloading.\n Supported protocols are HTTP/HTTPS/FTP/BitTorrent. It also supports Metalink\n version 3.0.\n\n Currently it has following features:\n - HTTP/HTTPS GET support\n - HTTP Proxy support\n - HTTP BASIC authentication support\n - HTTP Proxy authentication support\n - FTP support(active, passive mode)\n - FTP through HTTP proxy(GET command or tunneling)\n - Segmented download\n - Cookie support\n - It can run as a daemon process.\n - BitTorrent protocol support with fast extension.\n - Selective download in multi-file torrent\n - Metalink version 3.0 support(HTTP/FTP/BitTorrent).\n - Limiting download/upload speed\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"aria2 on Fedora 11\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041758.html\");\n script_id(861972);\n script_version(\"$Revision: 8205 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-21 07:30:37 +0100 (Thu, 21 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-28 10:00:59 +0200 (Fri, 28 May 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-8915\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Fedora Update for aria2 FEDORA-2010-8915\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of aria2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC11\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~1.9.3~1.fc11\", rls:\"FC11\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-01-02T10:54:05", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "Check for the Version of system-config-printer", "modified": "2017-12-22T00:00:00", "published": "2010-03-22T00:00:00", "id": "OPENVAS:1361412562310830950", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830950", "type": "openvas", "title": "Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"system-config-printer on Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64\";\ntag_insight = \"In mandriva 2010.0, there was a missing requires that make impossible\n to choose a printer though samba.\n Also, in mandriva 2010.0, the cups service couldn't be started if\n the user started s-c-p manually.\n This update fixes these issues.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-03/msg00032.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830950\");\n script_version(\"$Revision: 8228 $\");\n script_cve_id(\"CVE-2010-1512\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-22 08:29:52 +0100 (Fri, 22 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-03-22 11:34:53 +0100 (Mon, 22 Mar 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"MDVA\", value: \"2010:106\");\n script_name(\"Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of system-config-printer\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"python-smbc\", rpm:\"python-smbc~1.0.6~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"system-config-printer\", rpm:\"system-config-printer~1.1.13~12.4mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"system-config-printer-libs\", rpm:\"system-config-printer-libs~1.1.13~12.4mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2020-04-27T19:23:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "The Remote host is installed with Aria2 and is prone to directory\n traversal vulnerability.", "modified": "2020-04-23T00:00:00", "published": "2010-05-25T00:00:00", "id": "OPENVAS:1361412562310801341", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310801341", "type": "openvas", "title": "Aria2 metalink 'name' Directory Traversal Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Aria2 metalink 'name' Directory Traversal Vulnerability\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.801341\");\n script_version(\"2020-04-23T12:22:09+0000\");\n script_tag(name:\"last_modification\", value:\"2020-04-23 12:22:09 +0000 (Thu, 23 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2010-05-25 13:56:16 +0200 (Tue, 25 May 2010)\");\n script_cve_id(\"CVE-2010-1512\");\n script_bugtraq_id(40142);\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_name(\"Aria2 metalink 'name' Directory Traversal Vulnerability\");\n script_xref(name:\"URL\", value:\"http://secunia.com/secunia_research/2010-71/\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/archive/1/archive/1/511280/100/0/threaded\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2010 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_aria2_detect.nasl\");\n script_mandatory_keys(\"Aria2/Ver\");\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers to download files to directories\n outside of the intended download directory via directory traversal attacks.\");\n script_tag(name:\"affected\", value:\"Aria2 version prior to 1.9.3\");\n script_tag(name:\"insight\", value:\"The flaw is due to an error in the handling of metalink files. The 'name'\n attribute of a 'file' element in a metalink file is not properly sanitised.\");\n script_tag(name:\"solution\", value:\"Upgrade to Aria2 1.9.3.\");\n script_tag(name:\"summary\", value:\"The Remote host is installed with Aria2 and is prone to directory\n traversal vulnerability.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://sourceforge.net/projects/aria2/files/\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\naria2Ver = get_kb_item(\"Aria2/Ver\");\nif(!aria2Ver){\n exit(0);\n}\n\nif(version_is_less(version:aria2Ver, test_version:\"1.9.3\")){\n report = report_fixed_ver(installed_version:aria2Ver, fixed_version:\"1.9.3\");\n security_message(port: 0, data: report);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2018-01-02T10:53:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "Check for the Version of aria2", "modified": "2017-12-25T00:00:00", "published": "2010-05-28T00:00:00", "id": "OPENVAS:861961", "href": "http://plugins.openvas.org/nasl.php?oid=861961", "type": "openvas", "title": "Fedora Update for aria2 FEDORA-2010-8908", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for aria2 FEDORA-2010-8908\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"aria2 is a download utility with resuming and segmented downloading.\n Supported protocols are HTTP/HTTPS/FTP/BitTorrent. It also supports Metalink\n version 3.0.\n\n Currently it has following features:\n - HTTP/HTTPS GET support\n - HTTP Proxy support\n - HTTP BASIC authentication support\n - HTTP Proxy authentication support\n - FTP support(active, passive mode)\n - FTP through HTTP proxy(GET command or tunneling)\n - Segmented download\n - Cookie support\n - It can run as a daemon process.\n - BitTorrent protocol support with fast extension.\n - Selective download in multi-file torrent\n - Metalink version 3.0 support(HTTP/FTP/BitTorrent).\n - Limiting download/upload speed\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"aria2 on Fedora 12\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html\");\n script_id(861961);\n script_version(\"$Revision: 8243 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-25 07:30:04 +0100 (Mon, 25 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-28 10:00:59 +0200 (Fri, 28 May 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-8908\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Fedora Update for aria2 FEDORA-2010-8908\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of aria2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~1.9.3~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-01-06T13:04:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "Check for the Version of aria2", "modified": "2018-01-04T00:00:00", "published": "2010-05-28T00:00:00", "id": "OPENVAS:1361412562310831056", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831056", "type": "openvas", "title": "Mandriva Update for aria2 MDVSA-2010:106 (aria2)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for aria2 MDVSA-2010:106 (aria2)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability was discovered in aria2 which allows remote attackers\n to create arbitrary files via directory traversal sequences in the\n name attribute of a file element in a metalink file (CVE-2010-1512).\n\n This update fixes this issue.\n \n Packages for 2009.0 are provided as of the Extended Maintenance\n Program.\n Please visit this link to learn more:\n http://store.mandriva.com/product_info.php?cPath=149&products_id=490\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"aria2 on Mandriva Linux 2009.0,\n Mandriva Linux 2009.0/X86_64,\n Mandriva Linux 2009.1,\n Mandriva Linux 2009.1/X86_64,\n Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64,\n Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-05/msg00035.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831056\");\n script_version(\"$Revision: 8287 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-04 08:28:11 +0100 (Thu, 04 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-28 10:00:59 +0200 (Fri, 28 May 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"MDVSA\", value: \"2010:106\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Mandriva Update for aria2 MDVSA-2010:106 (aria2)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of aria2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~0.15.3~0.20080918.3.2mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~1.6.2~1.4mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~1.2.0~0.20090201.5.3mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~0.15.3~0.20080918.3.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:39:40", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "The remote host is missing updates announced in\nadvisory GLSA 201101-04.", "modified": "2019-03-14T00:00:00", "published": "2011-03-09T00:00:00", "id": "OPENVAS:136141256231069040", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231069040", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201101-04 (aria2)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa_201101_04.nasl 14171 2019-03-14 10:22:03Z cfischer $\n#\n# Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.69040\");\n script_version(\"$Revision: 14171 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-14 11:22:03 +0100 (Thu, 14 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-09 05:54:11 +0100 (Wed, 09 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Gentoo Security Advisory GLSA 201101-04 (aria2)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name:\"insight\", value:\"A directory traversal vulnerability has been found in aria2.\");\n script_tag(name:\"solution\", value:\"All aria2 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/aria2-1.9.3'\");\n\n script_xref(name:\"URL\", value:\"http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201101-04\");\n script_xref(name:\"URL\", value:\"http://bugs.gentoo.org/show_bug.cgi?id=320975\");\n script_tag(name:\"summary\", value:\"The remote host is missing updates announced in\nadvisory GLSA 201101-04.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-gentoo.inc\");\ninclude(\"revisions-lib.inc\");\n\nres = \"\";\nreport = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"net-misc/aria2\", unaffected: make_list(\"ge 1.9.3\"), vulnerable: make_list(\"lt 1.9.3\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2017-07-24T12:49:21", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "The remote host is missing an update to aria2\nannounced via advisory DSA 2047-1.", "modified": "2017-07-07T00:00:00", "published": "2010-06-03T00:00:00", "id": "OPENVAS:67399", "href": "http://plugins.openvas.org/nasl.php?oid=67399", "type": "openvas", "title": "Debian Security Advisory DSA 2047-1 (aria2)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2047_1.nasl 6614 2017-07-07 12:09:12Z cfischer $\n# Description: Auto-generated from advisory DSA 2047-1 (aria2)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability was discovered in aria2, a download client. The name\nattribute of the file element of metalink files is not properly\nsanitised before using it to download files. If a user is tricked into\ndownloading from a specially crafted metalink file, this can be\nexploited to download files to directories outside of the intended\ndownload directory.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.14.0-1+lenny2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.9.3-1.\n\nWe recommend that you upgrade your aria2 package.\";\ntag_summary = \"The remote host is missing an update to aria2\nannounced via advisory DSA 2047-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202047-1\";\n\n\nif(description)\n{\n script_id(67399);\n script_version(\"$Revision: 6614 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:12 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-03 22:55:24 +0200 (Thu, 03 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Debian Security Advisory DSA 2047-1 (aria2)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"aria2\", ver:\"0.14.0-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-12-14T11:48:26", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "Check for the Version of system-config-printer", "modified": "2017-12-13T00:00:00", "published": "2010-03-22T00:00:00", "id": "OPENVAS:830950", "href": "http://plugins.openvas.org/nasl.php?oid=830950", "type": "openvas", "title": "Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"system-config-printer on Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64\";\ntag_insight = \"In mandriva 2010.0, there was a missing requires that make impossible\n to choose a printer though samba.\n Also, in mandriva 2010.0, the cups service couldn't be started if\n the user started s-c-p manually.\n This update fixes these issues.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-03/msg00032.php\");\n script_id(830950);\n script_version(\"$Revision: 8092 $\");\n script_cve_id(\"CVE-2010-1512\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-13 07:31:16 +0100 (Wed, 13 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-03-22 11:34:53 +0100 (Mon, 22 Mar 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"MDVA\", value: \"2010:106\");\n script_name(\"Mandriva Update for system-config-printer MDVA-2010:106 (system-config-printer)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of system-config-printer\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"python-smbc\", rpm:\"python-smbc~1.0.6~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"system-config-printer\", rpm:\"system-config-printer~1.1.13~12.4mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"system-config-printer-libs\", rpm:\"system-config-printer-libs~1.1.13~12.4mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-12-15T11:57:57", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "Check for the Version of aria2", "modified": "2017-12-15T00:00:00", "published": "2010-05-28T00:00:00", "id": "OPENVAS:831056", "href": "http://plugins.openvas.org/nasl.php?oid=831056", "type": "openvas", "title": "Mandriva Update for aria2 MDVSA-2010:106 (aria2)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for aria2 MDVSA-2010:106 (aria2)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability was discovered in aria2 which allows remote attackers\n to create arbitrary files via directory traversal sequences in the\n name attribute of a file element in a metalink file (CVE-2010-1512).\n\n This update fixes this issue.\n \n Packages for 2009.0 are provided as of the Extended Maintenance\n Program.\n Please visit this link to learn more:\n http://store.mandriva.com/product_info.php?cPath=149&products_id=490\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"aria2 on Mandriva Linux 2009.0,\n Mandriva Linux 2009.0/X86_64,\n Mandriva Linux 2009.1,\n Mandriva Linux 2009.1/X86_64,\n Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64,\n Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-05/msg00035.php\");\n script_id(831056);\n script_version(\"$Revision: 8130 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-15 07:31:09 +0100 (Fri, 15 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-28 10:00:59 +0200 (Fri, 28 May 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"MDVSA\", value: \"2010:106\");\n script_cve_id(\"CVE-2010-1512\");\n script_name(\"Mandriva Update for aria2 MDVSA-2010:106 (aria2)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of aria2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~0.15.3~0.20080918.3.2mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~1.6.2~1.4mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~1.2.0~0.20090201.5.3mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"aria2\", rpm:\"aria2~0.15.3~0.20080918.3.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-07-02T21:10:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2010-1512"], "description": "The Remote host is installed with Aria2 and is prone to directory\n traversal vulnerability.", "modified": "2017-02-10T00:00:00", "published": "2010-05-25T00:00:00", "id": "OPENVAS:801341", "href": "http://plugins.openvas.org/nasl.php?oid=801341", "type": "openvas", "title": "Aria2 metalink 'name' Directory Traversal Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_aria2_metalink_dir_traversal_vuln.nasl 5263 2017-02-10 13:45:51Z teissa $\n#\n# Aria2 metalink 'name' Directory Traversal Vulnerability\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation will allow attackers to download files to directories\n outside of the intended download directory via directory traversal attacks.\n Impact Level: Application\";\ntag_affected = \"Aria2 version prior to 1.9.3\";\ntag_insight = \"The flaw is due to an error in the hanling of metalink files. The 'name'\n attribute of a 'file' element in a metalink file is not properly sanitised.\";\ntag_solution = \"Upgrade to Aria2 1.9.3,\n For updates refer to http://sourceforge.net/projects/aria2/files/\";\ntag_summary = \"The Remote host is installed with Aria2 and is prone to directory\n traversal vulnerability.\";\n\nif(description)\n{\n script_id(801341);\n script_version(\"$Revision: 5263 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-10 14:45:51 +0100 (Fri, 10 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-25 13:56:16 +0200 (Tue, 25 May 2010)\");\n script_cve_id(\"CVE-2010-1512\");\n script_bugtraq_id(40142);\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_name(\"Aria2 metalink 'name' Directory Traversal Vulnerability\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/secunia_research/2010-71/\");\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/archive/1/archive/1/511280/100/0/threaded\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2010 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_aria2_detect.nasl\");\n script_require_keys(\"Aria2/Ver\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\naria2Ver = get_kb_item(\"Aria2/Ver\");\nif(!aria2Ver){\n exit(0);\n}\n\nif(version_is_less(version:aria2Ver, test_version:\"1.9.3\")){\n security_message(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}