{"id": "SECURITYVULNS:DOC:15915", "bulletinFamily": "software", "title": "[Full-disclosure] CVSTrac 2.0.0 Denial of Service (DoS) vulnerability", "description": "SECURITY ADVISORY\r\n=================\r\n\r\nApplication: CVSTrac\r\nVersion: 2.0.0\r\nVulnerability: Denial of Service (DoS)\r\nIdentification: CVE-2007-0347\r\nDate: 2007-01-29 12:00 UTC\r\n\r\nDESCRIPTION\r\n-----------\r\n\r\nA Denial of Service (DoS) vulnerability exists in CVSTrac\r\n(http://www.cvstrac.org/) version 2.0.0, a web-based bug and patch-set\r\ntracking system for the version control systems CVS, Subversion and Git.\r\n\r\nThe vulnerability is in the Wiki-style text output formatter and is\r\ntriggered by special text constructs in commit messages, tickets and\r\nWiki pages. Only users with check-in permissions and Wiki or ticket edit\r\npermissions can perform an attack. But as the anonymous user usually\r\nis granted Wiki edit and ticket creation permissions, an attacker\r\nremotely and anonymously can cause a partial DoS (depending on the pages\r\nrequested) on a CVSTrac installation by opening a new ticket or editing\r\na Wiki page with an arbitrary text containing for instance the string\r\n"/foo/bar'quux".\r\n\r\nThe result of an attack is an error of the underlying SQLite RDBMS:\r\n\r\n| Database Error\r\n| db_exists: Database exists query failed\r\n| SELECT filename FROM filechng WHERE filename='foo/bar'quux'\r\n| Reason: near "quux": syntax error\r\n\r\nANALYSIS\r\n--------\r\n\r\nThe DoS vulnerability exists because the is_eow() function in "format.c"\r\ndoes NOT just check the first(!) character of the supplied string\r\nfor an End-Of-Word terminating character, but instead iterates over\r\nstring and this way can skip a single embedded quotation mark. The\r\nis_repository_file() function then in turn assumes that the filename\r\nstring can never contain a single quotation mark and traps into an SQL\r\nescaping problem.\r\n\r\nAn SQL injection via this technique is somewhat limited as is_eow()\r\nbails on whitespace. So while one _can_ do an SQL injection, one is\r\nlimited to SQL queries containing only characters which get past the\r\nfunction isspace(3). This effectively limits attacks to SQL commands\r\nlike "VACUUM".\r\n\r\nWORKAROUND\r\n----------\r\n\r\nAdministrators can quickly workaround by revoking permissions on the\r\nusers. Restoring those permissions, obviously, would require keeping\r\nvulnerable permissions on at least one infrequently used account like\r\n"setup" or using the CLI sqlite3(1) to manually add them back later.\r\n\r\nOne can resurrect an attacked CVSTrac 2.0.0 by fixing the texts in the\r\nunderlying SQLite database with the following small Perl script.\r\n\r\n##\r\n## cvstrack-resurrect.pl -- CVSTrac Post-Attack Database Resurrection\r\n## Copyright (c) 2007 Ralf S. Engelschall <rse@engelschall.com>\r\n##\r\n\r\nuse DBI; # requires OpenPKG perl-dbi\r\nuse DBD::SQLite; # requires OpenPKG perl-dbi, perl-dbi::with_dbd_sqlite=yes\r\nuse DBIx::Simple; # requires OpenPKG perl-dbix\r\nuse Date::Format; # requires OpenPKG perl-time\r\n\r\nmy $db_file = $ARGV[0];\r\n\r\nmy $db = DBIx::Simple->connect(\r\n "dbi:SQLite:dbname=$db_file", "", "",\r\n { RaiseError => 0, AutoCommit => 0 }\r\n);\r\n\r\nmy $eow = q{\x00\s.,:;?!)"'};\r\n\r\nsub fixup {\r\n my ($data) = @_;\r\n if ($$data =~ m:/[^$eow]*/[^$eow]*'[^$eow]+:s) {\r\n $$data =~ s:(/[^$eow]*/[^$eow]*)('[^$eow]+):$1 $2:sg;\r\n return 1;\r\n }\r\n return 0;\r\n}\r\n\r\nforeach my $rec ($db->query("SELECT name, invtime, text FROM wiki")->hashes()) {\r\n if (&fixup(\$rec->{"text"})) {\r\n printf("++ adjusting Wiki page \"%s\" as of %s\n",\r\n $rec->{"name"}, time2str("%Y-%m-%d %H:%M:%S", -$rec->{"invtime"}));\r\n $db->query("UPDATE wiki SET text = ? WHERE name = ? AND invtime = ?",\r\n $rec->{"text"}, $rec->{"name"}, $rec->{"invtime"});\r\n }\r\n}\r\nforeach my $rec ($db->query("SELECT tn, description, remarks FROM ticket")->hashes()) {\r\n if (&fixup(\$rec->{"description"}) or &fixup(\$rec->{"remarks"})) {\r\n printf("++ adjusting ticket #%d\n",\r\n $rec->{"tn"});\r\n $db->query("UPDATE ticket SET description = ?, remarks = ? WHERE tn = ?",\r\n $rec->{"description"}, $rec->{"remarks"}, $rec->{"tn"});\r\n }\r\n}\r\nforeach my $rec ($db->query("SELECT tn, chngtime, oldval, newval FROM tktchng")->hashes()) {\r\n if (&fixup(\$rec->{"oldval"}) or &fixup(\$rec->{"newval"})) {\r\n printf("++ adjusting ticket [%d] change as of %s\n",\r\n $rec->{"tn"}, time2str("%Y-%m-%d %H:%M:%S", $rec->{"chngtime"}));\r\n $db->query("UPDATE tktchng SET oldval = ?, newval = ? WHERE tn = ? AND chngtime = ?",\r\n $rec->{"oldval"}, $rec->{"newval"}, $rec->{"tn"}, $rec->{"chngtime"});\r\n }\r\n}\r\nforeach my $rec ($db->query("SELECT cn, message FROM chng")->hashes()) {\r\n if (&fixup(\$rec->{"message"})) {\r\n printf("++ adjusting change [%d]\n",\r\n $rec->{"cn"});\r\n $db->query("UPDATE chng SET message = ? WHERE cn = ?",\r\n $rec->{"message"}, $rec->{"cn"});\r\n }\r\n}\r\n\r\n$db->commit();\r\n$db->disconnect();\r\n\r\nRESOLUTION\r\n----------\r\n\r\nUpgrade to the now available CVSTrac 2.0.1:\r\nhttp://www.cvstrac.org/cvstrac-2.0.1.tar.gz\r\n\r\nOr apply the following upstream vendor patch against CVSTrac 2.0.0:\r\nhttp://www.cvstrac.org/cvstrac/chngview?cn=852\r\n\r\nIndex: cvstrac/format.c\r\n--- format.c 2006/07/05 01:06:50 1.87\r\n+++ format.c 2006/08/16 23:02:14 1.88\r\n@@ -77,6 +77,8 @@\r\n ** Return TRUE if *z points to the terminator for a word. Words\r\n ** are terminated by whitespace or end of input or any of the\r\n ** characters in zEnd.\r\n+** Note that is_eow() ignores zEnd characters _inside_ a word. They\r\n+** only count if they're followed by other EOW characters.\r\n */\r\n int is_eow(const char *z, const char *zEnd){\r\n if( zEnd==0 ) zEnd = ".,:;?!)\"'";\r\n@@ -123,6 +125,7 @@\r\n ** somewhere inside. Spaces in filenames aren't supported.\r\n */\r\n int is_repository_file(const char *z){\r\n+ char *s;\r\n int i;\r\n int gotslash=0;\r\n if( z[0]!='/' ) return 0;\r\n@@ -132,13 +135,12 @@\r\n if(!gotslash) return 0;\r\n\r\n /* see if it's in the repository. Note that we strip the leading '/' from the\r\n- * query. Note that the is_eow() check means there's no ' character.\r\n+ * query.\r\n */\r\n- if( !db_exists("SELECT filename FROM filechng WHERE filename='%.*s'",\r\n- i-1, &z[1]) ){\r\n- return 0;\r\n- }\r\n- return i;\r\n+ s = mprintf("%.*s", i-1, &z[1]);\r\n+ gotslash = db_exists("SELECT filename FROM filechng WHERE filename='%q'", s );\r\n+ free(s);\r\n+ return gotslash ? i : 0;\r\n }\r\n\r\n /*\r\n\r\nHISTORY\r\n-------\r\n\r\n2007-01-17 10:00 UTC: problem detected\r\n2007-01-17 11:30 UTC: vulnerability detected in format.c:is_eow()\r\n2007-01-17 12:15 UTC: vulnerability analized and first workaround patch created\r\n2007-01-17 12:45 UTC: database resurrection script written\r\n2007-01-17 13:00 UTC: upstream vendor notified\r\n2007-01-17 22:24 UTC: vendor confirmed vulnerability and provided official fix\r\n2007-01-18 09:22 UTC: vendor informed and CVE number requested from MITRE\r\n2007-01-18 20:08 UTC: received CVE number CVE-2007-0347 from MITRE\r\n2007-01-22 08:30 UTC: settled with vendor on an embargo date of 2007-01-29 12:00 UTC\r\n2007-01-22 09:00 UTC: pre-informed "vendor-sec"\r\n2007-01-29 12:00 UTC: send out RSE security advisory\r\n\r\n Ralf S. Engelschall\r\n rse@engelschall.com\r\n www.engelschall.com\r\n\r\n_______________________________________________\r\nFull-Disclosure - We believe in it.\r\nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\r\nHosted and sponsored by Secunia - http://secunia.com/", "published": "2007-01-30T00:00:00", "modified": "2007-01-30T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:15915", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2007-0347"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:21", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "2037ddde5f257d779f366fcbe532fc95"}, {"key": "cvss", "hash": "3873c836ae45fd496c2b40bae50467ed"}, {"key": "description", "hash": "75ab686fed5595a8e2a25cb1eec02970"}, {"key": "href", "hash": "9425944421772283b231259793e319a0"}, {"key": "modified", "hash": "68e50d4738eed37777d0333aae71f067"}, {"key": "published", "hash": "68e50d4738eed37777d0333aae71f067"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a49ebb2e1a771348dfa0039e0d589df6"}, {"key": "title", "hash": "162afca1fc4b4755120d81956c65d689"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "130ee929f4222c9f2a33f6ef40f9a4a217aba7da1035d77f0b5912ecc91c7b5e", "viewCount": 4, "enchantments": {"score": {"value": 6.1, "vector": "NONE", "modified": "2018-08-31T11:10:21"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-0347"]}, {"type": "exploitdb", "idList": ["EDB-ID:3223"]}, {"type": "openvas", "idList": ["OPENVAS:80015", "OPENVAS:136141256231080015"]}, {"type": "nessus", "idList": ["CVSTRAC_OUTPUT_FORMATTER_DOS.NASL"]}, {"type": "osvdb", "idList": ["OSVDB:31935"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7128"]}], "modified": "2018-08-31T11:10:21"}, "vulnersScore": 6.1}, "objectVersion": "1.3", "affectedSoftware": []}

{"cve": [{"lastseen": "2019-05-29T18:08:58", "bulletinFamily": "NVD", "description": "The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the \"'\" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entries.\nAn SQL injection via this technique is somewhat limited as is_eow() bails on whitespace. So while one _can_ do an SQL injection, one is limited to SQL queries containing only characters which get past the function isspace(3). This effectively limits attacks to SQL commands like \"VACUUM\".\nThe DoS vulnerability exists because the is_eow() function in \"format.c\" does NOT just check the FIRST character of the supplied string for an End-Of-Word terminating character, but instead iterates over string and this way can skip a single embedded quotation mark. The is_repository_file() function then in turn assumes that the filename string can never contain a single quotation mark and traps into a SQL escaping problem.\nSuccessful remote unauthenticated exploit requires that CVSTrac is explicitly configured to allow anonymous users to add tickets (it is not by default).", "modified": "2018-10-16T16:32:00", "id": "CVE-2007-0347", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0347", "published": "2007-01-29T20:28:00", "title": "CVE-2007-0347", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "exploitdb": [{"lastseen": "2016-01-31T18:00:12", "bulletinFamily": "exploit", "description": "CVSTrac 2.0.0 Post-Attack Database Resurrection DoS Exploit. CVE-2007-0347. Dos exploit for cgi platform", "modified": "2007-01-29T00:00:00", "published": "2007-01-29T00:00:00", "id": "EDB-ID:3223", "href": "https://www.exploit-db.com/exploits/3223/", "type": "exploitdb", "title": "CVSTrac 2.0.0 - Post-Attack Database Resurrection DoS Exploit", "sourceData": "##\r\n## cvstrack-resurrect.pl -- CVSTrac Post-Attack Database Resurrection\r\n## Copyright (c) 2007 Ralf S. Engelschall <rse@engelschall.com>\r\n##\r\n\r\nuse DBI; # requires OpenPKG perl-dbi\r\nuse DBD::SQLite; # requires OpenPKG perl-dbi, perl-dbi::with_dbd_sqlite=yes\r\nuse DBIx::Simple; # requires OpenPKG perl-dbix\r\nuse Date::Format; # requires OpenPKG perl-time\r\n\r\nmy $db_file = $ARGV[0];\r\n\r\nmy $db = DBIx::Simple->connect(\r\n \"dbi:SQLite:dbname=$db_file\", \"\", \"\",\r\n { RaiseError => 0, AutoCommit => 0 }\r\n);\r\n\r\nmy $eow = q{\\x00\\s.,:;?!)\"'};\r\n\r\nsub fixup {\r\n my ($data) = @_;\r\n if ($$data =~ m:/[^$eow]*/[^$eow]*'[^$eow]+:s) {\r\n $$data =~ s:(/[^$eow]*/[^$eow]*)('[^$eow]+):$1 $2:sg;\r\n return 1;\r\n }\r\n return 0;\r\n}\r\n\r\nforeach my $rec ($db->query(\"SELECT name, invtime, text FROM wiki\")->hashes()) {\r\n if (&fixup(\\$rec->{\"text\"})) {\r\n printf(\"++ adjusting Wiki page \\\"%s\\\" as of %s\\n\",\r\n $rec->{\"name\"}, time2str(\"%Y-%m-%d %H:%M:%S\", -$rec->{\"invtime\"}));\r\n $db->query(\"UPDATE wiki SET text = ? WHERE name = ? AND invtime = ?\",\r\n $rec->{\"text\"}, $rec->{\"name\"}, $rec->{\"invtime\"});\r\n }\r\n}\r\nforeach my $rec ($db->query(\"SELECT tn, description, remarks FROM ticket\")->hashes()) {\r\n if (&fixup(\\$rec->{\"description\"}) or &fixup(\\$rec->{\"remarks\"})) {\r\n printf(\"++ adjusting ticket #%d\\n\",\r\n $rec->{\"tn\"});\r\n $db->query(\"UPDATE ticket SET description = ?, remarks = ? WHERE tn = ?\",\r\n $rec->{\"description\"}, $rec->{\"remarks\"}, $rec->{\"tn\"});\r\n }\r\n}\r\nforeach my $rec ($db->query(\"SELECT tn, chngtime, oldval, newval FROM tktchng\")->hashes()) {\r\n if (&fixup(\\$rec->{\"oldval\"}) or &fixup(\\$rec->{\"newval\"})) {\r\n printf(\"++ adjusting ticket [%d] change as of %s\\n\",\r\n $rec->{\"tn\"}, time2str(\"%Y-%m-%d %H:%M:%S\", $rec->{\"chngtime\"}));\r\n $db->query(\"UPDATE tktchng SET oldval = ?, newval = ? WHERE tn = ? AND chngtime = ?\",\r\n $rec->{\"oldval\"}, $rec->{\"newval\"}, $rec->{\"tn\"}, $rec->{\"chngtime\"});\r\n }\r\n}\r\nforeach my $rec ($db->query(\"SELECT cn, message FROM chng\")->hashes()) {\r\n if (&fixup(\\$rec->{\"message\"})) {\r\n printf(\"++ adjusting change [%d]\\n\",\r\n $rec->{\"cn\"});\r\n $db->query(\"UPDATE chng SET message = ? WHERE cn = ?\",\r\n $rec->{\"message\"}, $rec->{\"cn\"});\r\n }\r\n}\r\n\r\n$db->commit();\r\n$db->disconnect();\r\n\r\n# milw0rm.com [2007-01-29]\r\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/3223/"}], "openvas": [{"lastseen": "2017-09-19T11:57:43", "bulletinFamily": "scanner", "description": "The remote web server contains a CGI script or is itself subject to a\ndenial of service attack. \n\nDescription :\n\nAccording to its version number, the version of CVSTrac installed on \nthe remote host contains a flaw related to its Wiki-style text output \nformatter that may allow an attacker to cause a partial denial of service,\ndepending on the pages requested.", "modified": "2017-09-18T00:00:00", "published": "2008-10-24T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=80015", "id": "OPENVAS:80015", "title": "CVSTrac text output formatter DoS", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: cvstrac_output_formatter_dos.nasl 7176 2017-09-18 12:01:01Z cfischer $\n# Description: CVSTrac text output formatter DoS\n#\n# Authors:\n# David Maciejak <david dot maciejak at kyxar dot fr>\n#\n# Copyright:\n# Copyright (C) 2007 David Maciejak\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_solution = \"Upgrade to CVSTrac 2.0.1 or later.\n\nCVSS Base Score : 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)\";\n\ntag_summary = \"The remote web server contains a CGI script or is itself subject to a\ndenial of service attack. \n\nDescription :\n\nAccording to its version number, the version of CVSTrac installed on \nthe remote host contains a flaw related to its Wiki-style text output \nformatter that may allow an attacker to cause a partial denial of service,\ndepending on the pages requested.\";\n\n\nif(description)\n{\n script_id(80015);\n script_version(\"$Revision: 7176 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-09-18 14:01:01 +0200 (Mon, 18 Sep 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-10-24 19:51:47 +0200 (Fri, 24 Oct 2008)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n\n script_cve_id(\"CVE-2007-0347\");\n script_bugtraq_id(22296);\n script_xref(name:\"OSVDB\", value:\"31935\");\n\n name = \"CVSTrac text output formatter DoS\";\n\n script_name(name);\n script_category(ACT_GATHER_INFO);\n \n script_copyright(\"This script is Copyright (C) 2007 David Maciejak\");\n family = \"Web application abuses\";\n script_family(family);\n script_dependencies(\"cvstrac_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/archive/1/458455/30/0/threaded\");\n exit(0);\n}\n\ninclude(\"http_func.inc\");\n\nport = get_http_port(default:80);\nkb = get_kb_item(\"www/\" + port + \"/cvstrac\" );\nif ( ! kb ) exit(0);\nstuff = eregmatch(pattern:\"(.*) under (.*)\", string:kb );\nversion = stuff[1]; \nif(ereg(pattern:\"^([01]\\.|2\\.0\\.0[^0-9.]?)\", string:version))\n\tsecurity_message(port);\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:40:29", "bulletinFamily": "scanner", "description": "The remote web server is running CVSTrac which is prone to a\n denial of service attack.", "modified": "2019-03-06T00:00:00", "published": "2008-10-24T00:00:00", "id": "OPENVAS:136141256231080015", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231080015", "title": "CVSTrac text output formatter DoS", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: cvstrac_output_formatter_dos.nasl 14021 2019-03-06 18:22:29Z cfischer $\n#\n# CVSTrac text output formatter DoS\n#\n# Authors:\n# David Maciejak <david dot maciejak at kyxar dot fr>\n#\n# Copyright:\n# Copyright (C) 2008 David Maciejak\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:cvstrac:cvstrac\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.80015\");\n script_version(\"$Revision: 14021 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-06 19:22:29 +0100 (Wed, 06 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2008-10-24 19:51:47 +0200 (Fri, 24 Oct 2008)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_cve_id(\"CVE-2007-0347\");\n script_bugtraq_id(22296);\n script_xref(name:\"OSVDB\", value:\"31935\");\n script_name(\"CVSTrac text output formatter DoS\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"This script is Copyright (C) 2008 David Maciejak\");\n script_family(\"Web application abuses\");\n script_dependencies(\"cvstrac_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"cvstrac/detected\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/archive/1/458455/30/0/threaded\");\n\n script_tag(name:\"solution\", value:\"Upgrade to CVSTrac 2.0.1 or later.\");\n\n script_tag(name:\"summary\", value:\"The remote web server is running CVSTrac which is prone to a\n denial of service attack.\");\n\n script_tag(name:\"insight\", value:\"According to its version number, the version of installed on\n the remote host contains a flaw related to its Wiki-style text output formatter.\");\n\n script_tag(name:\"impact\", value:\"This flaw may allow an attacker to cause a partial denial of service,\n depending on the pages requested.\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif( ! port = get_app_port( cpe:CPE ) )\n exit( 0 );\n\nif( ! vers = get_app_version( cpe:CPE, port:port ) )\n exit( 0 );\n\nif( ereg( pattern:\"^([01]\\.|2\\.0\\.0[^0-9.]?)\", string:vers ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.1.4\" );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:28", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nVendor Specific News/Changelog Entry: http://www.cvstrac.org/cvstrac/chngview?cn=850\n[Secunia Advisory ID:23940](https://secuniaresearch.flexerasoftware.com/advisories/23940/)\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0548.html\nMail List Post: http://www.securityfocus.com/archive/1/archive/1/458455/100/0/threaded\nGeneric Informational URL: http://www.cvstrac.org/cvstrac/tktview?tn=683\nGeneric Informational URL: http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.008.html\nFrSIRT Advisory: ADV-2007-0398\n[CVE-2007-0347](https://vulners.com/cve/CVE-2007-0347)\nBugtraq ID: 22296\n", "modified": "2007-01-29T00:00:00", "published": "2007-01-29T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:31935", "id": "OSVDB:31935", "title": "CVSTrac format.c Multiple Variable SQL Injection", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "nessus": [{"lastseen": "2019-11-01T02:18:15", "bulletinFamily": "scanner", "description": "According to its version number, the version of CVSTrac installed on\nthe remote host contains a flaw related to its Wiki-style text output\nformatter that may allow an attacker to cause a partial denial of\nservice, depending on the pages requested, via limited SQL injection.", "modified": "2019-11-02T00:00:00", "id": "CVSTRAC_OUTPUT_FORMATTER_DOS.NASL", "href": "https://www.tenable.com/plugins/nessus/24263", "published": "2007-01-30T00:00:00", "title": "CVSTrac Text Output Formatter SQL Injection DoS", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(24263);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/11/15 20:50:16\");\n\n script_cve_id(\"CVE-2007-0347\");\n script_bugtraq_id(22296);\n\n script_name(english:\"CVSTrac Text Output Formatter SQL Injection DoS\");\n script_summary(english:\"Checks CVSTrac version\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a CGI script or is itself subject to a\ndenial of service attack.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version number, the version of CVSTrac installed on\nthe remote host contains a flaw related to its Wiki-style text output\nformatter that may allow an attacker to cause a partial denial of\nservice, depending on the pages requested, via limited SQL injection.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.cvstrac.org/cvstrac/tktview?tn=683\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.cvstrac.org/cvstrac/chngview?cn=850\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.securityfocus.com/archive/1/458455/30/0/threaded\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to CVSTrac 2.0.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/01/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/01/30\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.\");\n script_family(english:\"CGI abuses\");\n\n script_dependencie(\"cvstrac_detect.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"http_func.inc\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\nport = get_http_port(default:80);\nkb = get_kb_item(\"www/\" + port + \"/cvstrac\" );\nif ( ! kb ) exit(0);\nstuff = eregmatch(pattern:\"(.*) under (.*)\", string:kb );\nversion = stuff[1];\nif(ereg(pattern:\"^([01]\\.|2\\.0\\.0[^0-9.]?)\", string:version))\n\tsecurity_warning(port);\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:22", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2007-01-29T00:00:00", "published": "2007-01-29T00:00:00", "id": "SECURITYVULNS:VULN:7128", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7128", "title": "Daily web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}