NVD

Id
13731  
Name
CVE-2010-2253  
Description
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-07-06  
Modified Date
2010-11-06  
Seq
2010-2253  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
76420 13731 CVE-2010-2253 http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes  View
76421 13731 CVE-2010-2253 FEDORA-2010-15405  View
76422 13731 CVE-2010-2253 FEDORA-2010-15532  View
76423 13731 CVE-2010-2253 [oss-security] 20100517 [oCERT-2010-001] multiple http client unexpected download filename vulnerability  View
76424 13731 CVE-2010-2253 [oss-security] 20100609 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability  View
76425 13731 CVE-2010-2253 http://www.ocert.org/advisories/ocert-2010-001.html  View
76426 13731 CVE-2010-2253 USN-981-1  View
76427 13731 CVE-2010-2253 ADV-2010-2872  View
76428 13731 CVE-2010-2253 https://bugzilla.redhat.com/show_bug.cgi?id=591580  View
76429 13731 CVE-2010-2253 https://bugzilla.redhat.com/show_bug.cgi?id=602800  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
39737 JVNDB-2010-005522 libwww-perl の lwp-download におけるファイルを作成される脆弱性 libwww-perl の lwp-download は、. (dot) 文字で開始するファイル名へのダウンロードを拒否しないため、ファイルを作成および上書きされる、および home ディレクトリ内の dotfile に書き込みされ任意のコードを実行される脆弱性が存在します。 CVE-2010-2253 44833 CVE-2010-2253 13731 6.8 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-005522.html 2010-07-06 2012-12-20 View