PT-2015-3214 · Lacie+1 · Lacie Fuel+2

Allen Harper + 2 · Publicado 2015-12-31 · Atualizado 2015-12-31 · CVE-2015-2875

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Seagate GoFlex Satellite versions prior to 3.4.1.105 Seagate Wireless Mobile Storage versions prior to 3.4.1.105 Seagate Wireless Plus Mobile Storage versions prior to 3.4.1.105 LaCie FUEL versions prior to 3.4.1.105

Description The issue allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session. This is due to an absolute path traversal vulnerability, which exists because of incorrect restriction of the directory path name with limited access.

Recommendations For Seagate GoFlex Satellite versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For Seagate Wireless Mobile Storage versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For Seagate Wireless Plus Mobile Storage versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For LaCie FUEL versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2016-00960

CVE-2015-2875

Produtos afetados

Lacie Fuel

Seagate Goflex Satellite

Seagate Wireless Mobile Storage

Referências · 5

• https://kb.cert.org/vuls/id/903500 · Nota
• https://bdu.fstec.ru/vul/2016-00960 · Nota de Segurança
• https://kb.cert.org/vuls/id/GWAN-A26L3F · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2875 · Nota de Segurança
• https://kb.cert.org/vuls/id/GWAN-9ZGTUH · Nota