PT-2015-3215 · Lacie+1 · Lacie Fuel+2

Published 2015-12-31 · Updated 2015-12-31 · CVE-2015-2876

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Seagate GoFlex Satellite versions prior to 3.4.1.105 Seagate Wireless Mobile Storage versions prior to 3.4.1.105 Seagate Wireless Plus Mobile Storage versions prior to 3.4.1.105 LaCie FUEL versions prior to 3.4.1.105

Description The issue is related to an unrestricted file upload, allowing remote attackers to execute arbitrary code by uploading a file to "/media/sda2" during a Wi-Fi session. This can be exploited to gain unauthorized access and control over the device.

Recommendations For Seagate GoFlex Satellite versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For Seagate Wireless Mobile Storage versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For Seagate Wireless Plus Mobile Storage versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. For LaCie FUEL versions prior to 3.4.1.105, update the firmware to version 3.4.1.105 or later. As a temporary workaround, consider restricting access to the "/media/sda2" directory during Wi-Fi sessions until the firmware is updated.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2016-00961

CVE-2015-2876

Affected Products

Lacie Fuel

Seagate Goflex Satellite

Seagate Wireless Mobile Storage

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-2876 · Security Note
• https://bdu.fstec.ru/vul/2016-00961 · Security Note
• https://kb.cert.org/vuls/id/903500 · Note
• https://kb.cert.org/vuls/id/GWAN-A26L3F · Note
• https://kb.cert.org/vuls/id/GWAN-9ZGTUH · Note