CVE-2009-4025
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 6.15% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- pear/pear
- Source
- secalert@redhat.com
References
- http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/Patch, Vendor Advisory
- http://osvdb.org/60515
- http://pear.php.net/advisory20091114-01.txtVendor Advisory
- http://pear.php.net/package/Net_Traceroute/download/0.21.2Patch
- http://secunia.com/advisories/37497
- http://secunia.com/advisories/37503
- http://security.gentoo.org/glsa/glsa-200911-06.xml
- http://www.openwall.com/lists/oss-security/2009/11/23/8
- http://www.securityfocus.com/bid/37094
- http://www.vupen.com/english/advisories/2009/3321Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54391
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00998.html
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01007.html
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01110.html
- http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/Patch, Vendor Advisory
- http://osvdb.org/60515
- http://pear.php.net/advisory20091114-01.txtVendor Advisory
- http://pear.php.net/package/Net_Traceroute/download/0.21.2Patch
- http://secunia.com/advisories/37497
- http://secunia.com/advisories/37503
- http://security.gentoo.org/glsa/glsa-200911-06.xml
- http://www.openwall.com/lists/oss-security/2009/11/23/8
- http://www.securityfocus.com/bid/37094
- http://www.vupen.com/english/advisories/2009/3321Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54391
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00998.html
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01007.html
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01110.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.