The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - nmap: arbitrary file upload flaw in http-domino-enum-passwords NSE script (CVE-2013-4885)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload arbitrarily named files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

The remote Solaris system is missing necessary patches to address security updates :

  - The http-domino-enum-passwords.nse script in NMap before     6.40, when domino-enum-passwords.idpath is set, allows     remote servers to upload 'arbitrarily named' files via a     crafted FullName parameter in a response, as     demonstrated using directory traversal sequences.
    (CVE-2013-4885)

nmap was updated to fix bnc#844953/CVE-2013-4885: There was a vulnerability in one of our 437 NSE scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system.

nmap was updated to fix the http-domino-enum-passwords scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system.

- updated for 6.40

    - fixes CVE-2013-4885 nmap: arbitrary file upload flaw       in http-domino-enum-passwords NSE script

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
200010	RHEL 6 : nmap (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
90100	Amazon Linux AMI : nmap (ALAS-2016-671)	Nessus	Amazon Linux Local Security Checks	medium
80710	Oracle Solaris Third-Party Patch Update : nmap (cve_2013_4885_unrestricted_file)	Nessus	Solaris Local Security Checks	medium
75175	openSUSE Security Update : nmap (openSUSE-SU-2013:1579-1)	Nessus	SuSE Local Security Checks	medium
75171	openSUSE Security Update : nmap (openSUSE-SU-2013:1561-1)	Nessus	SuSE Local Security Checks	medium
69485	Fedora 18 : nmap-6.40-1.fc18 (2013-14786)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4885

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium