CVE-2007-0159

Directory traversal vulnerability in the GeoIPupdatedatabasegeneral function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers possibly only update.maxmind.com to overwrite arbitrary files via a .. dot dot in the database filename, which is returned by a request to...

CVE-2007-0159: Undefined Security Weakness

Directory traversal vulnerability in the GeoIPupdatedatabasegeneral function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers possibly only update.maxmind.com to overwrite arbitrary files via a .. dot dot in the database filename, which is returned by a request to...

CVE-2007-0159

CVE-2007-0159 describes a directory traversal in the GeoIP project. The vulnerable component is the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c (GeoIP 1.4.0). A malicious update server (potentially update.maxmind.com) can cause the updater to write to arbitrary files by provi...

CVE-2007-0159

Directory traversal vulnerability in the GeoIPupdatedatabasegeneral function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers possibly only update.maxmind.com to overwrite arbitrary files via a .. dot dot in the database filename, which is returned by a request to...

[ MDKSA-2007:004 ] - Updated geoip packages fix geoipupdate vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:004 http://www.mandriva.com/security/ Package : geoip Date : January 8, 2007 Affected: Corporate 4.0 Problem Description: Dean Gaudet discovered the geoipupdate utility fails to do sanity checking on the...