PT-2010-4042 · S2 Security · S2 Security Netbox

Published 2010-06-25 · Updated 2017-08-17 · CVE-2010-2466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions S2 Security NetBox versions 2.x through 3.x

Description The issue allows remote attackers to obtain sensitive information by requesting database backup files with predictable filenames, specifically full *.dar files, due to improper prevention of downloading these backups.

Recommendations For versions 2.x through 3.x, restrict access to the database backup files to prevent unauthorized downloads until a proper fix is implemented. As a temporary workaround, consider implementing additional security measures to make the filenames of the backup files less predictable.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2466

Affected Products

S2 Security Netbox

References · 7

• 🔥 http://blip.tv/file/3414004 · Exploit
• 🔥 http://slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2466 · Security Note
• http://darkreading.com/blog/archives/2010/04/attacking_door.html · Note
• http://kb.cert.org/vuls/id/228737 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59826 · Note
• http://securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2 · Note