PT-2015-3214 · Lacie+1 · Lacie Fuel+2

Allen Harper + 2 · Published 2015-12-31 · Updated 2015-12-31 · CVE-2015-2875

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Seagate GoFlex Satellite versions prior to 3.4.1.105 Seagate Wireless Mobile Storage versions prior to 3.4.1.105 Seagate Wireless Plus Mobile Storage versions prior to 3.4.1.105 LaCie FUEL versions prior to 3.4.1.105

Description The issue allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session. This is due to an absolute path traversal vulnerability, which exists because of incorrect restriction of the directory path name with limited access.

Recommendations For Seagate GoFlex Satellite versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For Seagate Wireless Mobile Storage versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For Seagate Wireless Plus Mobile Storage versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For LaCie FUEL versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2016-00960

CVE-2015-2875

Affected Products

Lacie Fuel

Seagate Goflex Satellite

Seagate Wireless Mobile Storage

References · 5

• https://bdu.fstec.ru/vul/2016-00960 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2875 · Security Note
• https://kb.cert.org/vuls/id/903500 · Note
• https://kb.cert.org/vuls/id/GWAN-A26L3F · Note
• https://kb.cert.org/vuls/id/GWAN-9ZGTUH · Note