PT-2014-06 · Solar-Log · Solar-Log

Publicado 2014-04-11 · Atualizado 2014-04-11

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Solar-log (affected versions not specified)

Description The issue is related to errors in the code of the web server component used by default in the Solar-log photoelectric system. This allows an attacker to upload files to arbitrary paths, including system files, without authentication or by using a fixed solarlog:solarlog account. The issue can lead to the execution of arbitrary code and/or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

BDU:2014-00401

Produtos afetados

Solar-Log

Referências · 5

• http://securitylab.ru/lab/PT-2014-06 · Nota
• http://osvdb.org/show/osvdb/106641 · Nota
• https://bdu.fstec.ru/vul/2014-00401 · Nota de Segurança
• http://securityfocus.com/bid/67455 · Nota
• http://secunia.com/advisories/58396 · Nota