CVE-2000-0639
The default configuration of Big Brother 1.4h2 and earlier does not include proper access restrictions, which allows remote attackers to execute arbitrary commands by using bbd to upload a file whose extension will cause it to be executed as a CGI…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The default configuration of Big Brother 1.4h2 and earlier does not include proper access restrictions, which allows remote attackers to execute arbitrary commands by using bbd to upload a file whose extension will cause it to be executed as a CGI script by the web server.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 9.49% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- sean macguire/big brother
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2000-07/0171.htmlPatch, Vendor Advisory
- http://www.osvdb.org/1472
- http://www.securityfocus.com/bid/1494Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5103
- http://archives.neohapsis.com/archives/bugtraq/2000-07/0171.htmlPatch, Vendor Advisory
- http://www.osvdb.org/1472
- http://www.securityfocus.com/bid/1494Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5103
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.