full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] DDIVRT-2009-27 F2L-3000 fi

[Full-disclosure] DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

From: <ddivulnalert_at_nospam>
Date: Mon Jan 25 2010 - 18:58:09 GMT
To: full-disclosure@lists.grok.org.uk


Title



DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

Severity



Medium

Date Discovered



November 19, 2009

Discovered By



Digital Defense, Inc. Vulnerability Research Team Credit: Rob Kraus, Chris Graham and r@b13$

Vulnerability Description



The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL Injection. Exploitation of the vulnerability may allow attackers to bypass authentication and access sensitive information stored on the device.

Solution Description



A patch is not available at this time. Possible workarounds include disabling the vulnerable service, or limiting access to a set of trusted IP addresses.

Tested Systems / Software



F2L-3000 version 4.0.0 is the only platform that has been manually tested. Earlier versions and other, similar models may also be vulnerable as the platform is sold in various configurations.

Vendor Contact



Vendor Website: http://www.files2links.com/

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/