PT-2013-4571 · Microsoft+2 · Windows+2

Publicado 2013-11-16 · Atualizado 2013-11-19 · CVE-2013-3694

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BlackBerry Link versions prior to 1.2.1.31 on Windows BlackBerry Link versions prior to 1.1.1 build 39 on Mac OS X

Description The issue allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests. This can be achieved through a CSRF attack involving DNS rebinding, as the software does not require authentication for remote file-access folders.

Recommendations For BlackBerry Link on Windows, update to version 1.2.1.31 or later. For BlackBerry Link on Mac OS X, update to version 1.1.1 build 39 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-3694

Produtos afetados

Blackberry Link

Macos X

Windows

Referências · 3

• 🔥 http://blog.cmpxchg8b.com/2013/11/qnx.html · Exploit
• http://blackberry.com/btsc/KB35315 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-3694 · Nota de Segurança