Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

Vinny Guido discovered that multiple input sanitising vulnerabilities in Fckeditor, a rich text web editor component, may lead to the execution of arbitrary code.

The remote Fedora host is missing one or more security updates :

moin-1.8.4-2.fc11 :

This update removes the filemanager directory from the embedded FCKeditor, it contains code with know security vulnerabilities, even though that code couldn't be invoked when Moin was used with the default settings. Moin was probably not affected, but installing this update is still recommended as a security measure. CVE-2009-2265 is the related CVE identifier.

wxGTK-2.8.10-2.fc10 :

added fix for CVE-2009-2369

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update removes the filemanager and _samples directories from the embedded FCKeditor, they contain code with know security vulnerabilities, even though that code couldn't be invoked when Moin was used with the default settings. Moin was probably not affected, but installing this update is still recommended as a security measure.
CVE-2009-2265 is the related CVE identifier.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FCKeditor is installed on the remote host.  It is an open source HTML text editor that is typically bundled with web applications such Dokeos, GForge, Geeklog, and Xoops, although it can also be installed on its own. 

The installed version of the software fails to sanitize input passed to the 'CurrentFolder' parameter of the 'upload.php' script located under 'editor/filemanager/connectors/php'.  Provided PHP's 'magic_quotes_gpc' setting is disabled, an attacker may be able to leverage this issue to upload arbitrary files and execute commands on the remote system.

The version of Adobe ColdFusion running on the remote host is affected by an arbitrary file upload vulnerability. The installed version ships with a vulnerable version of an open source HTML text editor, FCKeditor, that fails to properly sanitize input passed to the 'CurrentFolder' parameter of the 'upload.cfm' script located under '/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm'.

An attacker can leverage this issue to upload arbitrary files and execute commands on the remote system subject to the privileges of the web server user id.

ID	Name	Product	Family	Severity
44701	Debian DSA-1836-1 : fckeditor - missing input sanitising	Nessus	Debian Local Security Checks	high
39866	Fedora 10 : wxGTK-2.8.10-2.fc10 / Fedora 11 : moin-1.8.4-2.fc11 (2009-7794)	Nessus	Fedora Local Security Checks	high
39862	Fedora 10 : moin-1.6.4-3.fc10 (2009-7761)	Nessus	Fedora Local Security Checks	high
39806	FCKeditor 'CurrentFolder' Arbitrary File Upload	Nessus	CGI abuses	high
39790	Adobe ColdFusion FCKeditor 'CurrentFolder' File Upload	Nessus	CGI abuses	high

Detections

Analytics

CVE-2009-2265

high

Tenable Plugins

high

high

high

high

high