PT-2010-4044 · S2 Security · S2 Security Netbox

Publicado 2010-06-25 · Atualizado 2017-08-17 · CVE-2010-2468

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions S2 Security NetBox versions 2.x through 3.x

Description The issue concerns the use of a weak hash algorithm for storing the Administrator password. This weakness makes it easier for attackers to obtain privileged access by recovering the cleartext of the password.

Recommendations For versions 2.x through 3.x, consider changing the Administrator password to a strong, unique password and avoid using the same password across multiple systems until a stronger hash algorithm is implemented. As a temporary workaround, restrict access to the Administrator account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2010-2468

Produtos afetados

S2 Security Netbox

Referências · 6

• 🔥 http://blip.tv/file/3414004 · Exploit
• 🔥 http://slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59827 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2468 · Nota de Segurança
• http://darkreading.com/blog/archives/2010/04/attacking_door.html · Nota
• http://securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2 · Nota