PT-2010-4042 · S2 Security · S2 Security Netbox

Publicado 2010-06-25 · Atualizado 2017-08-17 · CVE-2010-2466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions S2 Security NetBox versions 2.x through 3.x

Description The issue allows remote attackers to obtain sensitive information by requesting database backup files with predictable filenames, specifically full *.dar files, due to improper prevention of downloading these backups.

Recommendations For versions 2.x through 3.x, restrict access to the database backup files to prevent unauthorized downloads until a proper fix is implemented. As a temporary workaround, consider implementing additional security measures to make the filenames of the backup files less predictable.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2466

Produtos afetados

S2 Security Netbox

Referências · 7

• 🔥 http://blip.tv/file/3414004 · Exploit
• 🔥 http://slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon · Exploit
• http://darkreading.com/blog/archives/2010/04/attacking_door.html · Nota
• http://kb.cert.org/vuls/id/228737 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59826 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2466 · Nota de Segurança
• http://securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2 · Nota