Sign-up

ID

VAR-200605-0108


CVE

CVE-2006-2337


TITLE

IBM AIX nslookup fails to drop root privileges

Trust: 0.8

sources: CERT/CC: VU#18419

DESCRIPTION

Directory traversal vulnerability in webcm in the D-Link DSL-G604T Wireless ADSL Router Modem allows remote attackers to read arbitrary files via an absolute path in the getpage parameter. The nslookup command fails to drop privileges, allowing local attackers to gain root privileges

Trust: 2.61

sources: NVD: CVE-2006-2337 // CERT/CC: VU#18419 // CNVD: CNVD-2006-3106 // BID: 87629 // VULHUB: VHN-18445 // VULMON: CVE-2006-2337

IOT TAXONOMY

category:['IoT', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2006-3106

AFFECTED PRODUCTS

vendor:d linkmodel:dsl-g604tscope:eqversion:*

Trust: 1.0

vendor:d linkmodel:dsl-g604tscope: - version: -

Trust: 0.9

vendor:ibmmodel: - scope: - version: -

Trust: 0.8

vendor:nomodel: - scope: - version: -

Trust: 0.6

sources: CERT/CC: VU#18419 // CNVD: CNVD-2006-3106 // BID: 87629 // CNNVD: CNNVD-200605-191 // NVD: CVE-2006-2337

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-2337
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#18419
value: 2.76

Trust: 0.8

CNVD: CNVD-2006-3106
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-200605-191
value: MEDIUM

Trust: 0.6

VULHUB: VHN-18445
value: MEDIUM

Trust: 0.1

VULMON: CVE-2006-2337
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2006-2337
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2006-3106
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-18445
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#18419 // CNVD: CNVD-2006-3106 // VULHUB: VHN-18445 // VULMON: CVE-2006-2337 // CNNVD: CNNVD-200605-191 // NVD: CVE-2006-2337

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.1

sources: VULHUB: VHN-18445 // NVD: CVE-2006-2337

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200605-191

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-200605-191

EXTERNAL IDS

db:NVDid:CVE-2006-2337

Trust: 2.7

db:SECTRACKid:1016038

Trust: 2.0

db:XFid:26555

Trust: 1.5

db:XFid:604

Trust: 1.4

db:CERT/CCid:VU#18419

Trust: 0.8

db:CNNVDid:CNNVD-200605-191

Trust: 0.7

db:CNVDid:CNVD-2006-3106

Trust: 0.6

db:BUGTRAQid:20080301 THE ROUTER HACKING CHALLENGE IS OVER!

Trust: 0.6

db:BIDid:87629

Trust: 0.4

db:VULHUBid:VHN-18445

Trust: 0.1

db:VULMONid:CVE-2006-2337

Trust: 0.1

sources: CERT/CC: VU#18419 // CNVD: CNVD-2006-3106 // VULHUB: VHN-18445 // VULMON: CVE-2006-2337 // BID: 87629 // CNNVD: CNNVD-200605-191 // NVD: CVE-2006-2337

REFERENCES

url:http://www.gnucitizen.org/projects/router-hacking-challenge/

Trust: 2.1

url:http://www.securiteam.com/securitynews/5jp0220ikk.html

Trust: 2.1

url:http://securitytracker.com/id?1016038

Trust: 2.1

url:http://xforce.iss.net/xforce/xfdb/26555

Trust: 1.5

url:http://www.securityfocus.com/archive/1/489009/100/0/threaded

Trust: 1.2

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/26555

Trust: 1.2

url:http://www.securityfocus.com/archive/1/archive/1/489009/100/0/threaded

Trust: 0.9

url:http://xforce.iss.net/static/604.php

Trust: 0.8

url:http://groups.google.com/groups?q=ers-sva-e01-1997:008.1&hl=en&rnum=3&selm=6383r7%24kts%243%40watnews1.watson.ibm.com

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/22.html

Trust: 0.1

url:http://tools.cisco.com/security/center/viewalert.x?alertid=10883

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CERT/CC: VU#18419 // CNVD: CNVD-2006-3106 // VULHUB: VHN-18445 // VULMON: CVE-2006-2337 // BID: 87629 // CNNVD: CNNVD-200605-191 // NVD: CVE-2006-2337

CREDITS

Unknown

Trust: 0.3

sources: BID: 87629

SOURCES

db:CERT/CCid:VU#18419
db:CNVDid:CNVD-2006-3106
db:VULHUBid:VHN-18445
db:VULMONid:CVE-2006-2337
db:BIDid:87629
db:CNNVDid:CNNVD-200605-191
db:NVDid:CVE-2006-2337

LAST UPDATE DATE

2025-04-03T21:13:03.819000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#18419date:2001-09-27T00:00:00
db:CNVDid:CNVD-2006-3106date:2006-05-11T00:00:00
db:VULHUBid:VHN-18445date:2018-10-18T00:00:00
db:VULMONid:CVE-2006-2337date:2018-10-18T00:00:00
db:BIDid:87629date:2006-05-11T00:00:00
db:CNNVDid:CNNVD-200605-191date:2006-05-12T00:00:00
db:NVDid:CVE-2006-2337date:2025-04-03T01:03:51.193

SOURCES RELEASE DATE

db:CERT/CCid:VU#18419date:2001-09-26T00:00:00
db:CNVDid:CNVD-2006-3106date:2006-05-11T00:00:00
db:VULHUBid:VHN-18445date:2006-05-12T00:00:00
db:VULMONid:CVE-2006-2337date:2006-05-12T00:00:00
db:BIDid:87629date:2006-05-11T00:00:00
db:CNNVDid:CNNVD-200605-191date:2006-05-11T00:00:00
db:NVDid:CVE-2006-2337date:2006-05-12T00:02:00