ALPHA Ethernet Adapter II Web-Manager 3.40.2 Authentication Bypass

2010.07.11
Credit: ddivulnalert
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2010-2668
CWE: NVD-CWE-noinfo


CVSS Base Score: 6.4/10
Impact Subscore: 4.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

Title ----- DDIVRT-2010-29 ALPHA Ethernet Adapter II Web-Manager 3.40.2 Authentication Bypass Severity -------- High Date Discovered --------------- April 30th, 2010 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Edward Bullard, James Robertson and r@b13$ Vulnerability Description ------------------------- This version of Web-Manager contains a vulnerability which an intruder can leverage to gain read and write access to configuration settings through the device's web administration interface, leading to a full host compromise. Solution Description -------------------- No patch is available at this time. Tested Systems / Software (with versions) ------------------------------------------ Ubuntu Linux 9.10: Mozilla Firefox 3.5.9 Windows XP Professional Service Pack 3: Windows Internet Explorer 7.0.5730.13, Mozilla Firefox 3.6.3 Vendor Contact -------------- Vendor Name: Adaptive Micro Systems Inc. Vendor Website: http://www.adaptivedisplays.com/Default.asp

References:

http://www.securityfocus.com/bid/41288
http://www.securityfocus.com/archive/1/archive/1/512132/100/0/threaded
http://secunia.com/advisories/40369
http://osvdb.org/66015
http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0010.html


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top