The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set,     allows remote servers to upload arbitrarily named files via a crafted FullName parameter in a response,     as demonstrated using directory traversal sequences. (CVE-2013-4885)

Note that Nessus relies on the presence of the package as reported by the vendor.

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload arbitrarily named files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

The remote Solaris system is missing necessary patches to address security updates :

  - The http-domino-enum-passwords.nse script in NMap before     6.40, when domino-enum-passwords.idpath is set, allows     remote servers to upload 'arbitrarily named' files via a     crafted FullName parameter in a response, as     demonstrated using directory traversal sequences.
    (CVE-2013-4885)

nmap was updated to fix bnc#844953/CVE-2013-4885: There was a vulnerability in one of our 437 NSE scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system.

nmap was updated to fix the http-domino-enum-passwords scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system.

- updated for 6.40

    - fixes CVE-2013-4885 nmap: arbitrary file upload flaw       in http-domino-enum-passwords NSE script

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
217899	Linux Distros Unpatched Vulnerability : CVE-2013-4885	Nessus	Misc.	critical
90100	Amazon Linux AMI : nmap (ALAS-2016-671)	Nessus	Amazon Linux Local Security Checks	medium
80710	Oracle Solaris Third-Party Patch Update : nmap (cve_2013_4885_unrestricted_file)	Nessus	Solaris Local Security Checks	medium
75175	openSUSE Security Update : nmap (openSUSE-SU-2013:1579-1)	Nessus	SuSE Local Security Checks	medium
75171	openSUSE Security Update : nmap (openSUSE-SU-2013:1561-1)	Nessus	SuSE Local Security Checks	medium
69485	Fedora 18 : nmap-6.40-1.fc18 (2013-14786)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4885

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium