Details of VAR-200802-0295

ID

VAR-200802-0295

CVE

CVE-2008-1049

TITLE

Parallels H-Sphere Used in Parallels SiteStudio Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2008-005520

DESCRIPTION

Unspecified vulnerability in Parallels SiteStudio before 1.7.2, and 1.8.x before 1.8b, as used in Parallels H-Sphere 3.0 before Patch 9 and 2.5 before Patch 11, has unknown impact and attack vectors. H-Sphere SiteStudio is prone to an unspecified vulnerability. Very few technical details are currently available. We will update this BID as more information emerges. Successful attacks can compromise the application. Versions prior to H-Sphere SiteStudio 1.8b are affected. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: H-Sphere SiteStudio Unspecified Vulnerability SECUNIA ADVISORY ID: SA29084 VERIFY ADVISORY: http://secunia.com/advisories/29084/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: >From remote SOFTWARE: H-Sphere 2.x http://secunia.com/product/935/ SiteStudio 1.x http://secunia.com/product/5069/ DESCRIPTION: A vulnerability with unknown impact has been reported in H-Sphere SiteStudio. SOLUTION: Update to H-Sphere version 2.5 Patch 11 and SiteStudio version 1.7.2 (see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.psoft.net/misc/hs_ss_technical_update.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.98

sources: NVD: CVE-2008-1049 // JVNDB: JVNDB-2008-005520 // BID: 28002 // PACKETSTORM: 64075

AFFECTED PRODUCTS

vendor:	positive	model:	sitestudio	scope:	eq	version:	1.8	Trust: 1.6
vendor:	positive	model:	sitestudio	scope:	eq	version:	1.7.1	Trust: 1.6
vendor:	positive	model:	h-sphere	scope:	lte	version:	2.5_patch_10	Trust: 1.0
vendor:	positive	model:	h-sphere	scope:	lte	version:	3.0_patch_8	Trust: 1.0
vendor:	positive	model:	sitestudio	scope:	eq	version:	1.8b	Trust: 0.8
vendor:	positive	model:	sitestudio	scope:	lt	version:	1.8.x	Trust: 0.8
vendor:	positive	model:	h-sphere	scope:	eq	version:	3.0_patch_8	Trust: 0.6
vendor:	positive	model:	h-sphere	scope:	eq	version:	2.5_patch_10	Trust: 0.6
vendor:	parallels	model:	sitestudio	scope:	eq	version:	1.7.1	Trust: 0.3
vendor:	parallels	model:	sitestudio	scope:	eq	version:	1.7	Trust: 0.3
vendor:	parallels	model:	h-sphere patch	scope:	eq	version:	3.08	Trust: 0.3
vendor:	parallels	model:	h-sphere patch	scope:	eq	version:	2.510	Trust: 0.3
vendor:	parallels	model:	sitestudio	scope:	ne	version:	1.7.2	Trust: 0.3
vendor:	parallels	model:	sitestudio 1.8b	scope:	ne	version:	-	Trust: 0.3
vendor:	parallels	model:	h-sphere patch	scope:	ne	version:	3.09	Trust: 0.3
vendor:	parallels	model:	h-sphere patch	scope:	ne	version:	2.511	Trust: 0.3

sources: BID: 28002 // JVNDB: JVNDB-2008-005520 // CNNVD: CNNVD-200802-483 // NVD: CVE-2008-1049

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-1049
value:	HIGH
Trust: 1.0
NVD:	CVE-2008-1049
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200802-483
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2008-1049
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

sources: JVNDB: JVNDB-2008-005520 // CNNVD: CNNVD-200802-483 // NVD: CVE-2008-1049

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2008-1049

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200802-483

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200802-483

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-005520

PATCH

title:

Parallels H-Sphere and Parallels SiteStudio Technical Update

url:

http://www.psoft.net/misc/hs_ss_technical_update.html

Trust: 0.8

sources: JVNDB: JVNDB-2008-005520

EXTERNAL IDS

db:	NVD	id:	CVE-2008-1049	Trust: 2.7
db:	BID	id:	28002	Trust: 1.9
db:	SECUNIA	id:	29084	Trust: 1.7
db:	SECTRACK	id:	1019506	Trust: 1.6
db:	JVNDB	id:	JVNDB-2008-005520	Trust: 0.8
db:	XF	id:	40846	Trust: 0.6
db:	CNNVD	id:	CNNVD-200802-483	Trust: 0.6
db:	PACKETSTORM	id:	64075	Trust: 0.1

sources: BID: 28002 // JVNDB: JVNDB-2008-005520 // PACKETSTORM: 64075 // CNNVD: CNNVD-200802-483 // NVD: CVE-2008-1049

REFERENCES

url:	http://www.psoft.net/misc/hs_ss_technical_update.html	Trust: 2.0
url:	http://secunia.com/advisories/29084	Trust: 1.6
url:	http://www.securitytracker.com/id?1019506	Trust: 1.6
url:	http://www.securityfocus.com/bid/28002	Trust: 1.6
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/40846	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1049	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-1049	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/40846	Trust: 0.6
url:	http://www.psoft.net/hsdocumentation/versions/index.php?v=250p11	Trust: 0.3
url:	http://www.psoft.net/index.html	Trust: 0.3
url:	http://www.psoft.net/hsdocumentation/versions/?v=300p9&p=u	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/935/	Trust: 0.1
url:	https://psi.secunia.com/?page=changelog	Trust: 0.1
url:	https://psi.secunia.com/	Trust: 0.1
url:	http://secunia.com/product/5069/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/29084/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: BID: 28002 // JVNDB: JVNDB-2008-005520 // PACKETSTORM: 64075 // CNNVD: CNNVD-200802-483 // NVD: CVE-2008-1049

CREDITS

The vendor disclosed this issue.

Trust: 0.9

sources: BID: 28002 // CNNVD: CNNVD-200802-483

SOURCES

db:	BID	id:	28002
db:	JVNDB	id:	JVNDB-2008-005520
db:	PACKETSTORM	id:	64075
db:	CNNVD	id:	CNNVD-200802-483
db:	NVD	id:	CVE-2008-1049

LAST UPDATE DATE

2025-04-10T23:09:36.620000+00:00

SOURCES UPDATE DATE

db:	BID	id:	28002	date:	2015-04-16T18:05:00
db:	JVNDB	id:	JVNDB-2008-005520	date:	2012-12-20T00:00:00
db:	CNNVD	id:	CNNVD-200802-483	date:	2008-09-05T00:00:00
db:	NVD	id:	CVE-2008-1049	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	BID	id:	28002	date:	2008-02-26T00:00:00
db:	JVNDB	id:	JVNDB-2008-005520	date:	2012-12-20T00:00:00
db:	PACKETSTORM	id:	64075	date:	2008-02-27T00:18:33
db:	CNNVD	id:	CNNVD-200802-483	date:	2008-02-27T00:00:00
db:	NVD	id:	CVE-2008-1049	date:	2008-02-27T19:44:00