CVE-2008-1467

2008-03-2400:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.071 Low

EPSS

Percentile

94.0%

JSON

DISPUTED CenterIM 4.22.3 and earlier allows user-assisted remote
attackers to execute arbitrary commands via shell metacharacters in a URI,
related to “received URLs in the message window.” NOTE: this issue has
been disputed due to the user-assisted nature, since the URL must be
selected and launched by the victim.

Notes

Author	Note
jdstrand	per Debian, the victim needs to list the URLs in the message with F2 and press enter on it. the victim can see the complete URL including the commands however so the impact is really low

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchcenterim< 4.22.2-1ubuntu2UNKNOWN
ubuntu8.10noarchcenterim< 4.22.2-1ubuntu2UNKNOWN
ubuntu9.04noarchcenterim< 4.22.2-1ubuntu2UNKNOWN
ubuntu9.10noarchcenterim< 4.22.2-1ubuntu2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	centerim	< 4.22.2-1ubuntu2	UNKNOWN
ubuntu	8.10	noarch	centerim	< 4.22.2-1ubuntu2	UNKNOWN
ubuntu	9.04	noarch	centerim	< 4.22.2-1ubuntu2	UNKNOWN
ubuntu	9.10	noarch	centerim	< 4.22.2-1ubuntu2	UNKNOWN