full-disclosure - Re: [FD] Netgear GS105Ev2

Open Source and information security mailing list archives

Message-ID: <a4ef61c46d2e45c19281d3cd118eb9ca@DE-GN-ISEC-EX01.intern.i-sec.tuv.com>
Date: Tue, 8 Mar 2016 09:09:37 +0000
From: Benedikt Westermann <benedikt.westermann@...ec.tuv.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Netgear GS105Ev2 - Multiple Vulnerabilities

Hi Nick,

> The Netgear website [1] shows that a new version of the firmware was 
> released 2 days after your FD post - version 1.4.0.6.
> The release notes [2] for the new version don't refer to these 
> security issues in any way (instead they mention three fairly 
> minor-sounding bugs fixed).

>> Firmware version: 1.3.0.3,1.4.0.2
>> Status: unfixed

Status remains the same. The vulnerabilities are also valid for the new version 1.4.0.6. I checked it and could still reproduce the password-reset, the XSS, the CSRF, and the found also the cookie mentioned in the report after login. So,  nothing has changed with respect to the vulnerabilities.

Regards,
Benedikt

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (3586 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives