CVE:CVE-2011-3211
CNNVD:CNNVD-201109-130
Bcfg2 1.1.2和之前版本以及1.2预发行版本的服务器中存在输入验证漏洞。远程攻击者可以借助从客户端接收的数据中的shell元字符执行任意命令。
solution:Upgrade bcfg2 bcfg2 to a higher version than 1.1.2,0.3.1,0.4,0.5,0.6,0.6.1,0.6.3,0.6.4,0.6.5,0.6.6,0.6.7,0.6.8,0.6.9,0.6.10,0.7.0,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6.1,0.8.7,0.8.7.1,0.8.7.2,0.9.0,0.9.1d,0.9.2,0.9.3,0.9.4,0.9.5,0.9.5.1,0.9.5.2,0.9.5.3,0.9.5.5,0.9.5.7,0.9.6,1.0:pre1,1.0:pre2,1.0:pre4,1.0.0,1.0.1,1.1.0,1.1.1,1.2:prerelease,and avoid the version (,1.1.2],0.3.1,0.4,0.5,0.6,0.6.1,0.6.3,0.6.4,0.6.5,0.6.6,0.6.7,0.6.8,0.6.9,0.6.10,0.7.0,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6.1,0.8.7,0.8.7.1,0.8.7.2,0.9.0,0.9.1d,0.9.2,0.9.3,0.9.4,0.9.5,0.9.5.1,0.9.5.2,0.9.5.3,0.9.5.5,0.9.5.7,0.9.6,1.0:pre1,1.0:pre2,1.0:pre4,1.0.0,1.0.1,1.1.0,1.1.1,1.2:prerelease