PT-2014-6056 · Netgate · Pfsense

Publicado 2014-07-02 · Atualizado 2019-05-30 · CVE-2014-4690

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4

Description The issue allows remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to "pkg mgr install.php" and allows remote authenticated users to read arbitrary files via the downloadbackup parameter to "system firmware restorefullbackup.php".

Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "pkg mgr install.php" and "system firmware restorefullbackup.php" scripts until the update is applied. Avoid using the pkg and downloadbackup parameters in the affected API endpoints until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-4690

Produtos afetados

Pfsense

Referências · 2

• https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4690 · Nota de Segurança