CVE-2009-4025

Published: Nov 29, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.

Affected (4)

Products: Pear: Pear

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Pear Pear	Up to 0.21.1
Pear Pear	Version 0.11
Pear Pear	Version 0.20
Pear Pear	Version 0.21

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (28)

http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/

Source: secalert@redhat.com

PatchVendor Advisory

http://osvdb.org/60515

Source: secalert@redhat.com

http://pear.php.net/advisory20091114-01.txt

Source: secalert@redhat.com

Vendor Advisory

http://pear.php.net/package/Net_Traceroute/download/0.21.2

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/37497

Source: secalert@redhat.com

http://secunia.com/advisories/37503

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200911-06.xml

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2009/11/23/8

Source: secalert@redhat.com

http://www.securityfocus.com/bid/37094

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/3321

Source: secalert@redhat.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54391

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00998.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01007.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01110.html

Source: secalert@redhat.com

http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://osvdb.org/60515

Source: af854a3a-2127-422b-91ae-364da2661108

http://pear.php.net/advisory20091114-01.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://pear.php.net/package/Net_Traceroute/download/0.21.2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/37497

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37503

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200911-06.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/11/23/8

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/37094

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/3321

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54391

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00998.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01007.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01110.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.