|
|
| |
Credit:
The information has been provided by Andrea Micalizzi aka rgod.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-12-028/
|
| |
Vulnerable Systems:
* Rational Rhapsody
The specific flaws exists within BB FlashBack Recorder.dll. The Filename property is vulnerable to directory traversal via the Start() method. PauseAndSave() is also vulnerable to directory traversal via its nextfilename parameter. InsertMarker() and InsertSoundToFBRAtMarker() have parameters that are vulnerable to script injection and can be combined with the previously mentioned vulnerabilities to achieve remote arbitrary code execution.
Vendor Status:
IBM has issued an update to correct this vulnerability
Patch Availability:
http://www.ibm.com/support/docview.wss?uid=swg21576352
CVE Information:
CVE-2011-1392
Disclosure Timeline:
2011-06-29 - Vulnerability reported to vendor
2012-02-08 - Coordinated public release of advisory
|
|
|
