CVE-2008-6195

LANDesk Management Suite 8.80.1.1 - PXE TFTP Service Directory Traversal

Severity Score

7.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by ".." sequences, a different vulnerability than CVE-2008-1643.

Vulnerabilidad de salto de directorio en el servicio PXE TFTP PXEMTFTP.exe) en LANDesk Management Suite (LDMS) v8.80.1.1 y versiones anteriores permite a atacantes remotos leer ficheros de su elección a través del nombre del subdirectorio seguido por secuencias "..", una vulnerabilidad diferente a CVE-2008-1643.

*Credits: N/A

CVSS Scores

NISTv2 7.8

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-04-02 First Exploit
2009-02-19 CVE Reserved
2009-02-20 CVE Published
2024-01-27 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (5)

URL	Tag	Source
http://www.securityfocus.com/archive/1/490390/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/28577	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/48852	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/31591	2008-04-02

URL	Date	SRC
http://community.landesk.com/support/docs/DOC-2659	2018-10-11

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Landesk Search vendor "Landesk"		Landesk Management Suite Search vendor "Landesk" for product "Landesk Management Suite"				<= 8.80.1.1 Search vendor "Landesk" for product "Landesk Management Suite" and version " <= 8.80.1.1"		-		Affected
Landesk Search vendor "Landesk"		Landesk Management Suite Search vendor "Landesk" for product "Landesk Management Suite"				8.7 Search vendor "Landesk" for product "Landesk Management Suite" and version "8.7"		-		Affected
Landesk Search vendor "Landesk"		Landesk Management Suite Search vendor "Landesk" for product "Landesk Management Suite"				8.7 Search vendor "Landesk" for product "Landesk Management Suite" and version "8.7"		sp5		Affected