PT-2009-2607 · Eye Fi · Eye-Fi

Published 2009-09-01 · Updated 2018-10-11 · CVE-2008-7138

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Eye-Fi version 1.1.2

Description The issue allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce value, which is predictable based on the time of day.

Recommendations For Eye-Fi version 1.1.2, consider disabling the authentication mechanism that relies on snonce values until a patch is available to prevent remote attackers from bypassing authentication.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2008-7138

Affected Products

Eye-Fi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-7138 · Security Note
• http://secunia.com/advisories/29221 · Vendor Advisory
• http://osvdb.org/42719 · Note
• http://securityfocus.com/archive/1/489045/100/0/threaded · Note
• http://securityfocus.com/bid/28085 · Note
• http://informit.com/articles/article.aspx?p=1177111&seqNum=2 · Note