CVE:CVE-2008-2230
CNNVD:CNNVD-200806-158
reportbug 3.8和3.31版本以及reportbug-ng 0.2008.06.04之前的版本存在不可信任的搜索路径漏洞。本地用户可以借助目前正在工作的目录中的一个恶意的模块文件,执行任意代码。
solution:Upgrade reportbug-ng reportbug to a higher version than 3.8,3.31,and avoid the version 3.8,3.31; Upgrade reportbug-ng reportbug-ng to a higher version than 0.2007.03.10,0.2007.03.11,0.2007.03.13,0.2007.03.14,0.2007.03.15,0.2007.03.17,0.2007.03.19,0.2007.03.19.2,0.2007.03.20,0.2007.03.24,0.2007.03.27,0.2007.03.28,0.2007.03.29,0.2007.04.07,0.2007.04.07.2,0.2007.04.13,0.2007.04.16,0.2007.04.20,0.2007.04.23,0.2007.04.27,0.2007.05.02,0.2007.05.27,0.2007.05.28,0.2007.05.31,0.2007.06.13,0.2007.06.27,0.2007.07.08,0.2007.07.12,0.2007.07.18,0.2007.07.19,0.2007.08.02,0.2007.08.03,0.2007.08.03.2,0.2007.08.12,0.2007.08.20,0.2007.10.30,0.2008.01.20,0.2008.03.26,0.2008.03.28,and avoid the version 0.2007.03.10,0.2007.03.11,0.2007.03.13,0.2007.03.14,0.2007.03.15,0.2007.03.17,0.2007.03.19,0.2007.03.19.2,0.2007.03.20,0.2007.03.24,0.2007.03.27,0.2007.03.28,0.2007.03.29,0.2007.04.07,0.2007.04.07.2,0.2007.04.13,0.2007.04.16,0.2007.04.20,0.2007.04.23,0.2007.04.27,0.2007.05.02,0.2007.05.27,0.2007.05.28,0.2007.05.31,0.2007.06.13,0.2007.06.27,0.2007.07.08,0.2007.07.12,0.2007.07.18,0.2007.07.19,0.2007.08.02,0.2007.08.03,0.2007.08.03.2,0.2007.08.12,0.2007.08.20,0.2007.10.30,0.2008.01.20,0.2008.03.26,0.2008.03.28