lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 25 Jan 2010 11:36:42 -0700
Subject: DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability


Date Discovered
November 19, 2009

Discovered By
Digital Defense, Inc. Vulnerability Research Team
Credit: Rob Kraus, Chris Graham and r@...$

Vulnerability Description
The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL Injection. Exploitation of the vulnerability may allow attackers to bypass authentication and access sensitive information stored on the device.

Solution Description
A patch is not available at this time. Possible workarounds include disabling the vulnerable service, or limiting access to a set of trusted IP addresses.

Tested Systems / Software 
F2L-3000 version 4.0.0 is the only platform that has been manually tested. Earlier versions and other, similar models may also be vulnerable as the platform is sold in various configurations.

Vendor Contact
Vendor Website:

Powered by blists - more mailing lists