config_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bscw | Fraunhofer_fit | 3.4 (including) | 3.4 (including) |
| Bscw | Fraunhofer_fit | 4.0 (including) | 4.0 (including) |
References
- http://bscw.gmd.de/WhatsNew.html
- http://www.iss.net/security_center/static/7774.php
- http://www.securityfocus.com/archive/1/248000
- http://www.securityfocus.com/bid/3776
- http://bscw.gmd.de/WhatsNew.html
- http://www.iss.net/security_center/static/7774.php
- http://www.securityfocus.com/archive/1/248000
- http://www.securityfocus.com/bid/3776