PT-2011-2733 · Smc · Smc Smcd3G-Ccr

Matthew Jakubowski + 1 · Publicado 2011-02-08 · Atualizado 2018-10-09 · CVE-2011-0887

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SMC SMCD3G-CCR (aka Comcast Business Gateway) versions prior to 1.4.0.49.2

Description The issue concerns the web management portal of the affected device, which uses predictable session IDs based on time values. This predictability makes it easier for remote attackers to hijack sessions via a brute-force attack on the userid cookie.

Recommendations For versions prior to 1.4.0.49.2, update the firmware to version 1.4.0.49.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web management portal to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-0887

Produtos afetados

Smc Smcd3G-Ccr

Referências · 10

• 🔥 https://trustwave.com/spiderlabs/advisories/TWSL2011-002.txt · Exploit
• 🔥 https://exploit-db.com/exploits/16123 · Exploit
• 🔥 http://seclists.org/bugtraq/2011/Feb/36 · Exploit
• 🔥 http://exploit-db.com/exploits/16123 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0887 · Nota de Segurança
• http://securityfocus.com/bid/46215 · Nota
• http://securityfocus.com/archive/1/516205/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65186 · Nota
• http://securityreason.com/securityalert/8068 · Nota
• http://secunia.com/advisories/43199 · Nota