full-disclosure - DDIVRT-2013-50 EverFocus EPARA264-16X1 Directory Traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 15 Mar 2013 09:44:07 -0500
From: ddivulnalert <ddivulnalert@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-2013-50 EverFocus EPARA264-16X1 Directory
	Traversal

Title
-----
DDIVRT-2013-50 EverFocus EPARA264-16X1 Directory Traversal

Severity
--------
High

Date Discovered
---------------
January 22, 2013

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: r@...$

Vulnerability Description
-------------------------
The EverFocus EPARA264-16X1 DVR allows unauthenticated remote users to
retrieve arbitrary system files that are located outside of the web
root through a directory traversal on port 80.

Solution Description
--------------------
EverFocus has provided a solution for this security issue in the form
of a firmware upgrade. EPARA264-16X1 devices with firmware version
1.0.3 or later are not affected by the security issue. The firmware
update is available from EverFocus technical support.

Tested Systems / Software
-------------------------
EverFocus EPARA264-16X1 Firmware Version 1.0.2

Vendor Contact
--------------
Vendor Name: EverFocus 
Vendor Website: http://www.everfocus.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/