PT-2010-4041 · S2 Security · S2 Security Netbox

Shawn Merdinger · Publicado 2010-06-25 · Atualizado 2010-07-13 · CVE-2010-2465

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions S2 Security NetBox versions 2.5, 3.3, 4.0

Description The issue allows remote attackers to download sensitive information, including node logs, photographs of persons, and backup files, via unspecified HTTP requests due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations For version 2.5, 3.3, and 4.0, restrict access to sensitive information stored under the web root to prevent unauthorized downloads. As a temporary workaround, consider restricting access to the web root until a proper fix is applied. Avoid using HTTP requests that could lead to the exposure of sensitive information until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2465

Produtos afetados

S2 Security Netbox

Referências · 10

• 🔥 http://blip.tv/file/3414004 · Exploit
• 🔥 http://slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon · Exploit
• http://secunia.com/advisories/40374 · Nota
• http://kb.cert.org/vuls/id/MAPG-83TQL8 · Nota
• http://darkreading.com/blog/archives/2010/04/attacking_door.html · Nota
• http://kb.cert.org/vuls/id/251133 · Nota
• http://osvdb.org/65757 · Nota
• http://securityfocus.com/bid/41134 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2465 · Nota de Segurança
• http://securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2 · Nota