Ãë¾àÁ¡ID |
21350 |
À§Çèµµ |
30 |
Æ÷Æ® |
80, ... |
ÇÁ·ÎÅäÄÝ |
TCP |
ºÐ·ù |
CGI |
»ó¼¼¼³¸í |
ÇØ´ç À¥ ¼¹ö¿¡ ¼³Ä¡µÇ¾î ÀÖ´Â phpGroupWare ¹öÀü¿¡ µû¸£¸é, phpGroupWare¿¡´Â ¾ÏȣȵÇÁö ¾ÊÀº ÄíŰ ÀÎÁõ ½Å¿ë Á¤º¸µéÀ» ³ëÃâÇÒ ¼ö ÀÖ´Â Ãë¾àÁ¡ÀÌ Á¸ÀçÇÑ´Ù. Joseph EngoÀÇ phpGroupWare ´Â ÀüÀÚ¿ìÆí, ͏°´õ, To-Do ¸ñ·Ï°ú °°Àº ±â´ÉÀ» Æ÷ÇÔÇÏ´Â PHP ·Î Á¦ÀÛµÈ À¥ ±â¹ÝÀÇ ±×·ì¿þ¾î ½Ã½ºÅÛÀÌ´Ù. phpGroupWare ÀϺΠ¹öÀüµé¿¡´Â ¾ÏȣȵÇÁö ¾ÊÀº ÄíŰ ÀÎÁõ ½Å¿ë Á¤º¸µéÀ» ³ëÃâÇÒ ¼ö ÀÖ´Â Ãë¾àÁ¡ÀÌ Á¸ÀçÇÏ´Â µ¥, ÀÌ´Â ¾ÖÇø®ÄÉÀ̼ÇÀÌ Çì´õ admin °ú ÆÐ½º¿öµå¸¦ ¾ÏȣȵÇÁö ¾ÊÀº ÄíŰ·Î ¼³Á¤Çϱ⠶§¹®ÀÌ´Ù. phpGroupWareÀÇ À¥ °ü¸®°¡ ¾ÏÈ£ÈµÈ ¸µÅ© »ó¿¡ ±¸¼ºµÇÁö ¾Ê´Â °æ¿ì, °ø°ÝÀÚµéÀº ³×Æ®¿öÅ© Æ®·¡ÇÈÀ» ½º´ÏÇÎ(sniffing)ÇÏ¿© ½±°Ô ÆÐ½º¿öµå Á¤º¸µéÀ» ȹµæÇÒ ¼ö ÀÖ´Ù. ÀÌ´Â º¸´Ù Áö´ÉÀûÀÎ ½Ã½ºÅÛ ÇØÅ·¿¡ µµ¿ò¿¡ ÀÌ¿ëµÉ ¼ö ÀÖ´Ù.
* ¾Ë¸²: ÀÌ Á¡°ËÇ׸ñÀº ÀÌ Ãë¾àÁ¡À» Á¡°ËÇϱâ À§ÇØ ÇØ´ç phpGroupWare ¹öÀü Á¤º¸¸¸À» È®ÀÎÇÑ´Ù. µû¶ó¼ °ÅÁþ ¾ç¼º¹ÝÀÀ(False Positive)À» º¸ÀÏ ¼ö ÀÖ´Ù.
* Âü°í »çÀÌÆ®: http://www.osvdb.org/8354
* ¿µÇâÀ» ¹Þ´Â Ç÷§Æû: Joseph Engo: phpGroupWare 0.9.14.007, 0.9.14.006, 0.9.14.005, 0.9.14.003 Joseph Engo: phpGroupWare 0.9.16.000, 0.9.16.001 Joseph Engo: phpGroupWare 0.9.13 Joseph Engo: phpGroupWare 0.9.12 Debian Linux 2.2 Conectiva Linux 7.0, 8.0, 9.0 Linux Any version Windows Any version Unix Any version |
ÇØ°áÃ¥ |
phpGroupWare ´Ù¿î·Îµå »çÀÌÆ®ÀÎ http://prdownloads.sourceforge.net/phpgroupware/ ¿¡¼ phpGroupWareÀÇ °¡Àå ÃֽйöÀü(0.9.16.002 ¶Ç´Â ±× ÀÌÈÄ)À» ±¸ÇÏ¿© ¾÷±×·¹À̵å ÇÏ¿©¾ß ÇÑ´Ù. |
°ü·Ã URL |
CVE-2004-2578 (CVE) |
°ü·Ã URL |
10895 (SecurityFocus) |
°ü·Ã URL |
16970 (ISS) |
|