NVD

Id
11029  
Name
CVE-2011-4675  
Description
The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-12-05  
Modified Date
2011-12-12  
Seq
2011-4675  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
61536 11029 CVE-2011-4675 http://bazaar.launchpad.net/~widelands-dev/widelands/build-15/revision/5021  View
61537 11029 CVE-2011-4675 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617960  View
61538 11029 CVE-2011-4675 widelands-filesystem-file-overwrite(71626)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32956 JVNDB-2011-003196 Widelands におけるパストラバーサル攻撃を誘発される脆弱性 Widelands の io/filesystem/filesystem.cc 内のパス名正規化機能は、ネットワーク経由で受け取った ~ (チルダ) で始まる文字列の、ホームディレクトリパス名への使用を制限しないため、パストラバーサル攻撃を誘発する、または任意のファイルを上書きされる脆弱性が存在します。 CVE-2011-4675 52582 CVE-2011-4675 11029 6.4 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-003196.html 2011-12-05 2011-12-12 View