CVE-2008-0932 Command injection in n/a
Remote attackers can execute arbitrary commands via shell metacharacters in the range parameter of Diatheke.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-0932?
CVE-2008-0932 is a high-severity command injection vulnerability in n/a, published on 25 Feb 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.
Weakness: CWE-20
Which versions are affected by CVE-2008-0932?
It affects 2 products.
Products include The Sword Project Diatheke Front End, The Sword Project Sword.
How do I fix CVE-2008-0932?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2008-0932 being exploited?
There is no known exploitation of CVE-2008-0932 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2008-0932, DSA-1508-1, GHSA-vc92-qxjw-hqcx.