CVE		CVE-2009-4025
Status		Candidate
Description		Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter.  NOTE: some of these details are obtained from third party information.
Severity		High
CVSS score		10
CVSS vector		(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Phase		Assigned (19.12.2009)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4025
References		BID : 37094
		CONFIRM : http://blog.pear.php.net/2009/11/14/net_traceroute...
		CONFIRM : http://pear.php.net/advisory20091114-01.txt
		CONFIRM : http://pear.php.net/package/Net_Traceroute/downloa...
		FEDORA : FEDORA-2009-11551
		FEDORA : FEDORA-2009-11617
		FEDORA : FEDORA-2009-12083
		GENTOO : GLSA-200911-06
		MLIST : [oss-security] 20091123 CVE request: Argument injections in multiple PEAR packages
		OSVDB : 60515
		SECUNIA : 37497
		SECUNIA : 37503
		VUPEN : ADV-2009-3321
		XF : nettraceroute-traceroute-command-execution(54391)
SecurityVulns:		PHP multiple security vulnerabilities