Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier, as used in Borland CaliberRM and probably other products, allows remote attackers to execute arbitrary commands via a request to TCP port 5019 with a modified VERSANT_ROOT field.

The version of the Versant Object Database installed on the remote host accepts input supplied by the client and uses it to launch needed programs or locate database files.  An unauthenticated, remote attacker can leverage this issue to execute arbitrary commands on the affected host subject to the privileges under which the service operates, which under Windows is SYSTEM.

Detections

Analytics

CVE-2008-1319

critical

Tenable Plugins

critical