製品・ソフトウェアに関する情報

JVN脆弱性詳細

Prosody の HTTP file-serving モジュールにおけるディレクトリトラバーサルの脆弱性

Title	Prosody の HTTP file-serving モジュールにおけるディレクトリトラバーサルの脆弱性
Summary	Prosody の HTTP file-serving モジュール (mod_http_files) には、ディレクトリトラバーサルの脆弱性が存在します。
Possible impacts	第三者により、.. (ドットドット) を含む不特定のパスを介して、任意のファイルを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 8, 2016, midnight
Registration Date	Jan. 26, 2016, 10:48 a.m.
Last Update	Jan. 26, 2016, 10:48 a.m.

Affected System

Debian

Debian GNU/Linux 7.0

Debian GNU/Linux 8.0

Debian GNU/Linux 7.0

Debian GNU/Linux 8.0

The Prosody Team

Prosody 0.9.9 未満の 0.9.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1231	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1231
2	CVE-2016-1231	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1231
National Vulnerability Database (NVD)
3	CVE-2016-1231	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1231
4	CVE-2016-1231	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1231

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html
2	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3439	https://www.debian.org/security/2016/dsa-3439
2	DSA-3439	https://www.debian.org/security/2016/dsa-3439
The Prosody Team
3	#520 mod_http_files allows access outside of http_files_dir	https://prosody.im/issues/issue/520
4	#520 mod_http_files allows access outside of http_files_dir	https://prosody.im/issues/issue/520
5	Prosody 0.9.9 security release	http://blog.prosody.im/prosody-0-9-9-security-release/
6	Prosody 0.9.9 security release	http://blog.prosody.im/prosody-0-9-9-security-release/
7	Prosody security advisory 2016/01/08 - 1	https://prosody.im/security/advisory_20160108-1/
8	Prosody security advisory 2016/01/08 - 1	https://prosody.im/security/advisory_20160108-1/

Change Log

No	Changed Details	Date of change
0	[2016年01月26日] 掲載	Feb. 17, 2018, 10:37 a.m.
0	[2016年01月26日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-1231

Summary	Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.
Publication Date	Jan. 13, 2016, 5:59 a.m.
Registration Date	Jan. 26, 2021, 2:06 p.m.
Last Update	Nov. 21, 2024, 11:46 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://blog.prosody.im/prosody-0-9-9-security-release/	Patch Vendor Advisory
2	http://blog.prosody.im/prosody-0-9-9-security-release/	Patch Vendor Advisory
3	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html
5	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html
6	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html
7	http://www.debian.org/security/2016/dsa-3439
8	http://www.debian.org/security/2016/dsa-3439
9	http://www.openwall.com/lists/oss-security/2016/01/08/5
10	http://www.openwall.com/lists/oss-security/2016/01/08/5
11	https://prosody.im/issues/issue/520
12	https://prosody.im/issues/issue/520
13	https://prosody.im/security/advisory_20160108-1/	Vendor Advisory
14	https://prosody.im/security/advisory_20160108-1/	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html