diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.

The remote host is affected by the vulnerability described in GLSA-200803-06 (SWORD: Shell command injection)

    Dan Dennison reported that the diatheke.pl script used in SWORD does     not properly sanitize shell meta-characters in the 'range' parameter     before processing it.
  Impact :

    A remote attacker could provide specially crafted input to a vulnerable     application, possibly resulting in the remote execution of arbitrary     shell commands with the privileges of the user running SWORD (generally     the web server account).
  Workaround :

    There is no known workaround at this time.

- Thu Feb 21 2008 Deji Akingunola <dakingun at gmail.com>
    - 1.5.10-2

    - Fix command injection bug (Bug #433723)

    - Mon Nov 5 2007 Deji Akingunola <dakingun at gmail.com>
      - 1.5.10-1

    - Update to version 1.5.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Feb 21 2008 Deji Akingunola <dakingun at gmail.com>
    - 1.5.10-2

    - Fix command injection bug (Bug #433723)

    - Tue Nov 6 2007 Deji Akingunola <dakingun at gmail.com>
      - 1.5.10-1

    - Update to version 1.5.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dan Dennison discovered that Diatheke, a CGI program to make a bible website, performs insufficient sanitising of a parameter, allowing a remote attacker to execute arbitrary shell commands as the web server user.

ID	Name	Product	Family	Severity
31381	GLSA-200803-06 : SWORD: Shell command injection	Nessus	Gentoo Local Security Checks	high
31175	Fedora 8 : sword-1.5.10-2.fc8 (2008-1951)	Nessus	Fedora Local Security Checks	high
31174	Fedora 7 : sword-1.5.10-2.fc7 (2008-1922)	Nessus	Fedora Local Security Checks	high
31169	Debian DSA-1508-1 : diatheke - insufficient input sanitising	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-0932

critical

Tenable Plugins

high

high

high

high