PT-2009-2607 · Eye Fi · Eye-Fi

Publicado 2009-09-01 · Atualizado 2018-10-11 · CVE-2008-7138

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Eye-Fi version 1.1.2

Description The issue allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce value, which is predictable based on the time of day.

Recommendations For Eye-Fi version 1.1.2, consider disabling the authentication mechanism that relies on snonce values until a patch is available to prevent remote attackers from bypassing authentication.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2008-7138

Produtos afetados

Eye-Fi

Referências · 6

• http://osvdb.org/42719 · Nota
• http://securityfocus.com/archive/1/489045/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7138 · Nota de Segurança
• http://securityfocus.com/bid/28085 · Nota
• http://secunia.com/advisories/29221 · Aviso do Fabricante
• http://informit.com/articles/article.aspx?p=1177111&seqNum=2 · Nota