CVE-2005-2482 Information

Description

The StateToOptions function in msfweb in Metasploit Framework 2.4 and earlier when running with the -D option (defanged mode) allows attackers to modify temporary environment variables before the _Defanged\ environment option is checked when processing the Exploit command.

Reference

http://metasploit.com/archive/framework/msg00469.html http://secunia.com/advisories/16318 http://www.osvdb.org/18495 http://www.securityfocus.com/bid/14455 https://exchange.xforce.ibmcloud.com/vulnerabilities/21705