PT-2010-4041 · S2 Security · S2 Security Netbox

Shawn Merdinger · Published 2010-06-25 · Updated 2010-07-13 · CVE-2010-2465

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions S2 Security NetBox versions 2.5, 3.3, 4.0

Description The issue allows remote attackers to download sensitive information, including node logs, photographs of persons, and backup files, via unspecified HTTP requests due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations For version 2.5, 3.3, and 4.0, restrict access to sensitive information stored under the web root to prevent unauthorized downloads. As a temporary workaround, consider restricting access to the web root until a proper fix is applied. Avoid using HTTP requests that could lead to the exposure of sensitive information until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2465

Affected Products

S2 Security Netbox

References · 10

• 🔥 http://blip.tv/file/3414004 · Exploit
• 🔥 http://slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2465 · Security Note
• http://secunia.com/advisories/40374 · Note
• http://kb.cert.org/vuls/id/MAPG-83TQL8 · Note
• http://darkreading.com/blog/archives/2010/04/attacking_door.html · Note
• http://kb.cert.org/vuls/id/251133 · Note
• http://osvdb.org/65757 · Note
• http://securityfocus.com/bid/41134 · Note
• http://securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2 · Note