{"id": "SECURITYVULNS:DOC:27492", "bulletinFamily": "software", "title": "[SECURITY] [DSA 2365-1] dtc security update", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2365-1 security@debian.org\r\nhttp://www.debian.org/security/ Moritz Muehlenhoff\r\nDecember 18, 2011 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : dtc\r\nVulnerability : several\r\nProblem type : local/remote\r\nDebian-specific: no\r\nCVE ID : CVE-2011-3195 CVE-2011-3196 CVE-2011-3197 CVE-2011-3198 \r\n CVE-2011-3199 \r\nDebian Bug : 637469 637477 637485 637584 637629 637630 637618 637537 637487 637632 637669\r\n\r\nAnsgar Burchardt, Mike O'Connor and Philipp Kern discovered multiple \r\nvulnerabilities in DTC, a web control panel for admin and accounting \r\nhosting services:\r\n\r\nCVE-2011-3195\r\n\r\n A possible shell insertion has been found in the mailing list\r\n handling.\r\n\r\nCVE-2011-3196\r\n\r\n Unix rights for the apache2.conf were set incorrectly (world\r\n readable).\r\n\r\nCVE-2011-3197\r\n\r\n Incorrect input sanitising for the $_SERVER["addrlink"] parameter\r\n could lead to SQL insertion.\r\n\r\nCVE-2011-3198\r\n\r\n DTC was using the -b option of htpasswd, possibly revealing\r\n password in clear text using ps or reading /proc.\r\n\r\nCVE-2011-3199\r\n\r\n A possible HTML/javascript insertion vulnerability has been found\r\n in the DNS & MX section of the user panel.\r\n\r\nThis update also fixes several vulnerabilities, for which no CVE ID\r\nhas been assigned:\r\n\r\nIt has been discovered that DTC performs insufficient input sanitising\r\nin the package installer, leading to possible unwanted destination\r\ndirectory for installed packages if some DTC application packages\r\nare installed (note that these aren't available in Debian main).\r\n\r\nDTC was setting-up /etc/sudoers with permissive sudo rights to\r\nchrootuid.\r\n\r\nIncorrect input sanitizing in the package installer could lead to\r\nSQL insertion.\r\n\r\nA malicious user could enter a specially crafted support ticket\r\nsubject leading to an SQL injection in the draw_user_admin.php.\r\n\r\nFor the oldstable distribution (lenny), this problem has been fixed in\r\nversion 0.29.18-1+lenny2\r\n\r\nThe stable distribution (squeeze) doesn't include dtc.\r\n\r\nFor the unstable distribution (sid), this problem has been fixed in\r\nversion 0.34.1-1.\r\n\r\nWe recommend that you upgrade your dtc packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n\r\n\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.11 (GNU/Linux)\r\n\r\niEYEARECAAYFAk7uTYgACgkQXm3vHE4uylr/JACgl1mPf6jUuSjsmOR4XAAd7IfG\r\nf+sAoKnzBNiOQmdsL+tuB3mbJW7Gtx2f\r\n=dODf\r\n-----END PGP SIGNATURE-----\r\n", "published": "2011-12-26T00:00:00", "modified": "2011-12-26T00:00:00", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27492", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2011-3198", "CVE-2011-3197", "CVE-2011-3196", "CVE-2011-3195", "CVE-2011-3199"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:43", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "766157e0fbf1dc934edf0dbc6566d165"}, {"key": "cvss", "hash": "9acfc3ecd06539a3534549fd05dfad8e"}, {"key": "description", "hash": "9ccc52d10b8c68fc0b5715c851e17f45"}, {"key": "href", "hash": "931fd0d4c0ce4d640c4bfc4cbf424c3e"}, {"key": "modified", "hash": "48989ce16a7539f175b7f00189e0d2fa"}, {"key": "published", "hash": "48989ce16a7539f175b7f00189e0d2fa"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a49ebb2e1a771348dfa0039e0d589df6"}, {"key": "title", "hash": "4fd0d71bc14523decbcf4837f3340b28"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "b4a54f30087e96405c71ea2c3ac423abae76e781bf702bacf75cc923328c1ec3", "viewCount": 18, "enchantments": {"score": {"value": 6.5, "vector": "NONE", "modified": "2018-08-31T11:10:43", "rev": 2}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:70577", "OPENVAS:136141256231070577"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-2365.NASL"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2365-1:0908E"]}, {"type": "cve", "idList": ["CVE-2011-3197", "CVE-2011-3199", "CVE-2011-3198", "CVE-2011-3195", "CVE-2011-3196"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:12117"]}], "modified": "2018-08-31T11:10:43", "rev": 2}, "vulnersScore": 6.5}, "objectVersion": "1.3", "affectedSoftware": []}

{"nessus": [{"lastseen": "2020-03-17T23:00:27", "bulletinFamily": "scanner", "description": "Ansgar Burchardt, Mike O", "modified": "2012-01-12T00:00:00", "id": "DEBIAN_DSA-2365.NASL", "href": "https://www.tenable.com/plugins/nessus/57505", "published": "2012-01-12T00:00:00", "title": "Debian DSA-2365-1 : dtc - several vulnerabilities", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2365. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(57505);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/03/12\");\n\n script_cve_id(\"CVE-2011-3195\", \"CVE-2011-3196\", \"CVE-2011-3197\", \"CVE-2011-3198\", \"CVE-2011-3199\");\n script_bugtraq_id(49267);\n script_xref(name:\"DSA\", value:\"2365\");\n\n script_name(english:\"Debian DSA-2365-1 : dtc - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Ansgar Burchardt, Mike O'Connor and Philipp Kern discovered multiple\nvulnerabilities in DTC, a web control panel for admin and accounting\nhosting services :\n\n - CVE-2011-3195\n A possible shell insertion has been found in the mailing\n list handling.\n\n - CVE-2011-3196\n Unix rights for the apache2.conf were set incorrectly\n (world readable).\n\n - CVE-2011-3197\n Incorrect input sanitising for the $_SERVER['addrlink']\n parameter could lead to SQL insertion.\n\n - CVE-2011-3198\n DTC was using the -b option of htpasswd, possibly\n revealing password in clear text using ps or reading\n /proc.\n\n - CVE-2011-3199\n A possible HTML/JavaScript insertion vulnerability has\n been found in the DNS & MX section of the user panel.\n\nThis update also fixes several vulnerabilities, for which no CVE ID\nhas been assigned :\n\nIt has been discovered that DTC performs insufficient input sanitising\nin the package installer, leading to possible unwanted destination\ndirectory for installed packages if some DTC application packages are\ninstalled (note that these aren't available in Debian main).\n\nDTC was setting-up /etc/sudoers with permissive sudo rights to\nchrootuid.\n\nIncorrect input sanitizing in the package installer could lead to SQL\ninsertion.\n\nA malicious user could enter a specially crafted support ticket\nsubject leading to a SQL injection in the draw_user_admin.php.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637469\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637477\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637485\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637584\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637618\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637537\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637487\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637632\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637669\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-3195\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-3196\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-3197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-3198\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-3199\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2011/dsa-2365\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the dtc packages.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.29.18-1+lenny2.\n\nThe stable distribution (squeeze) doesn't include dtc.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:dtc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/12/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"dtc\", reference:\"0.29.18-1+lenny2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2017-07-24T12:51:10", "bulletinFamily": "scanner", "description": "The remote host is missing an update to dtc\nannounced via advisory DSA 2365-1.", "modified": "2017-07-07T00:00:00", "published": "2012-02-11T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=70577", "id": "OPENVAS:70577", "title": "Debian Security Advisory DSA 2365-1 (dtc)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2365_1.nasl 6612 2017-07-07 12:08:03Z cfischer $\n# Description: Auto-generated from advisory DSA 2365-1 (dtc)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Ansgar Burchardt, Mike O'Connor and Philipp Kern discovered multiple\nvulnerabilities in DTC, a web control panel for admin and accounting\nhosting services:\n\nCVE-2011-3195\n\nA possible shell insertion has been found in the mailing list\nhandling.\n\nCVE-2011-3196\n\nUnix rights for the apache2.conf were set incorrectly (world\nreadable).\n\nCVE-2011-3197\n\nIncorrect input sanitising for the $_SERVER[addrlink] parameter\ncould lead to SQL insertion.\n\nCVE-2011-3198\n\nDTC was using the -b option of htpasswd, possibly revealing\npassword in clear text using ps or reading /proc.\n\nCVE-2011-3199\n\nA possible HTML/javascript insertion vulnerability has been found\nin the DNS & MX section of the user panel.\n\nThis update also fixes several vulnerabilities, for which no CVE ID\nhas been assigned:\n\nIt has been discovered that DTC performs insufficient input sanitising\nin the package installer, leading to possible unwanted destination\ndirectory for installed packages if some DTC application packages\nare installed (note that these aren't available in Debian main).\n\nDTC was setting-up /etc/sudoers with permissive sudo rights to\nchrootuid.\n\nIncorrect input sanitizing in the package installer could lead to\nSQL insertion.\n\nA malicious user could enter a specially crafted support ticket\nsubject leading to an SQL injection in the draw_user_admin.php.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.29.18-1+lenny2\n\nThe stable distribution (squeeze) doesn't include dtc.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.34.1-1.\n\nWe recommend that you upgrade your dtc packages.\";\ntag_summary = \"The remote host is missing an update to dtc\nannounced via advisory DSA 2365-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202365-1\";\n\nif(description)\n{\n script_id(70577);\n script_cve_id(\"CVE-2011-3195\", \"CVE-2011-3196\", \"CVE-2011-3197\",\n \"CVE-2011-3198\", \"CVE-2011-3199\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_version(\"$Revision: 6612 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:03 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-11 02:34:48 -0500 (Sat, 11 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2365-1 (dtc)\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"dtc-common\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-core\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-cyrus\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-postfix-courier\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-stats-daemon\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-toaster\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:38:50", "bulletinFamily": "scanner", "description": "The remote host is missing an update to dtc\nannounced via advisory DSA 2365-1.", "modified": "2019-03-18T00:00:00", "published": "2012-02-11T00:00:00", "id": "OPENVAS:136141256231070577", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070577", "title": "Debian Security Advisory DSA 2365-1 (dtc)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2365_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2365-1 (dtc)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70577\");\n script_cve_id(\"CVE-2011-3195\", \"CVE-2011-3196\", \"CVE-2011-3197\",\n \"CVE-2011-3198\", \"CVE-2011-3199\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-11 02:34:48 -0500 (Sat, 11 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2365-1 (dtc)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB5\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202365-1\");\n script_tag(name:\"insight\", value:\"Ansgar Burchardt, Mike O'Connor and Philipp Kern discovered multiple\nvulnerabilities in DTC, a web control panel for admin and accounting\nhosting services:\n\nCVE-2011-3195\n\nA possible shell insertion has been found in the mailing list\nhandling.\n\nCVE-2011-3196\n\nUnix rights for the apache2.conf were set incorrectly (world\nreadable).\n\nCVE-2011-3197\n\nIncorrect input sanitising for the $_SERVER[addrlink] parameter\ncould lead to SQL insertion.\n\nCVE-2011-3198\n\nDTC was using the -b option of htpasswd, possibly revealing\npassword in clear text using ps or reading /proc.\n\nCVE-2011-3199\n\nA possible HTML/javascript insertion vulnerability has been found\nin the DNS & MX section of the user panel.\n\nThis update also fixes several vulnerabilities, for which no CVE ID\nhas been assigned:\n\nIt has been discovered that DTC performs insufficient input sanitising\nin the package installer, leading to possible unwanted destination\ndirectory for installed packages if some DTC application packages\nare installed (note that these aren't available in Debian main).\n\nDTC was setting-up /etc/sudoers with permissive sudo rights to\nchrootuid.\n\nIncorrect input sanitizing in the package installer could lead to\nSQL insertion.\n\nA malicious user could enter a specially crafted support ticket\nsubject leading to an SQL injection in the draw_user_admin.php.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.29.18-1+lenny2\n\nThe stable distribution (squeeze) doesn't include dtc.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.34.1-1.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your dtc packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to dtc\nannounced via advisory DSA 2365-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"dtc-common\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-core\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-cyrus\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-postfix-courier\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-stats-daemon\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"dtc-toaster\", ver:\"0.29.18-1+lenny2\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:22:37", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2365-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nDecember 18, 2011 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : dtc\nVulnerability : several\nProblem type : local/remote\nDebian-specific: no\nCVE ID : CVE-2011-3195 CVE-2011-3196 CVE-2011-3197 CVE-2011-3198 \n CVE-2011-3199 \nDebian Bug : 637469 637477 637485 637584 637629 637630 637618 637537 637487 637632 637669\n\nAnsgar Burchardt, Mike O&#x27;Connor and Philipp Kern discovered multiple \nvulnerabilities in DTC, a web control panel for admin and accounting \nhosting services:\n\nCVE-2011-3195\n\n A possible shell insertion has been found in the mailing list\n handling.\n\nCVE-2011-3196\n\n Unix rights for the apache2.conf were set incorrectly (world\n readable).\n\nCVE-2011-3197\n\n Incorrect input sanitising for the $_SERVER[&quot;addrlink&quot;] parameter\n could lead to SQL insertion.\n\nCVE-2011-3198\n\n DTC was using the -b option of htpasswd, possibly revealing\n password in clear text using ps or reading /proc.\n\nCVE-2011-3199\n\n A possible HTML/javascript insertion vulnerability has been found\n in the DNS &amp; MX section of the user panel.\n\nThis update also fixes several vulnerabilities, for which no CVE ID\nhas been assigned:\n\nIt has been discovered that DTC performs insufficient input sanitising\nin the package installer, leading to possible unwanted destination\ndirectory for installed packages if some DTC application packages\nare installed (note that these aren&#x27;t available in Debian main).\n\nDTC was setting-up /etc/sudoers with permissive sudo rights to\nchrootuid.\n\nIncorrect input sanitizing in the package installer could lead to\nSQL insertion.\n\nA malicious user could enter a specially crafted support ticket\nsubject leading to an SQL injection in the draw_user_admin.php.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.29.18-1+lenny2\n\nThe stable distribution (squeeze) doesn&#x27;t include dtc.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.34.1-1.\n\nWe recommend that you upgrade your dtc packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n\n\n\n", "modified": "2011-12-18T20:48:08", "published": "2011-12-18T20:48:08", "id": "DEBIAN:DSA-2365-1:0908E", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2011/msg00243.html", "title": "[SECURITY] [DSA 2365-1] dtc security update", "type": "debian", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2019-05-29T18:11:20", "bulletinFamily": "NVD", "description": "Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments.", "modified": "2014-03-21T14:44:00", "id": "CVE-2011-3198", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3198", "published": "2014-03-21T04:38:00", "title": "CVE-2011-3198", "type": "cve", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:11:20", "bulletinFamily": "NVD", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (2) DNS and (3) MX form, as demonstrated by the \"Domain root TXT record:\" field.", "modified": "2014-03-27T22:00:00", "id": "CVE-2011-3199", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3199", "published": "2014-03-21T04:38:00", "title": "CVE-2011-3199", "type": "cve", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:11:20", "bulletinFamily": "NVD", "description": "The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file.", "modified": "2014-03-27T22:02:00", "id": "CVE-2011-3196", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3196", "published": "2014-03-21T04:38:00", "title": "CVE-2011-3196", "type": "cve", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:11:20", "bulletinFamily": "NVD", "description": "SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272 has been assigned for the vps_note parameter to dtcadmin/logPushlet.php vector.", "modified": "2014-03-27T21:59:00", "id": "CVE-2011-3197", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3197", "published": "2014-03-21T04:38:00", "title": "CVE-2011-3197", "type": "cve", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:11:20", "bulletinFamily": "NVD", "description": "shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.", "modified": "2014-03-21T14:37:00", "id": "CVE-2011-3195", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3195", "published": "2014-03-21T04:38:00", "title": "CVE-2011-3195", "type": "cve", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:45", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2011-12-26T00:00:00", "published": "2011-12-26T00:00:00", "id": "SECURITYVULNS:VULN:12117", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:12117", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}