bugtraq - DDIVRT-2010-29 ALPHA Ethernet Adapter II Web-Manager 3.40.2 Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 1 Jul 2010 08:26:12 -0600
From: ddivulnalert@...frontline.com
To: bugtraq@...urityfocus.com
Subject: DDIVRT-2010-29 ALPHA Ethernet Adapter II Web-Manager 3.40.2
 Authentication Bypass

Title
-----
DDIVRT-2010-29 ALPHA Ethernet Adapter II Web-Manager 3.40.2 Authentication Bypass

Severity
--------
High

Date Discovered
---------------
April 30th, 2010

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Edward Bullard, James Robertson and r@...$

Vulnerability Description
-------------------------
This version of Web-Manager contains a vulnerability which an intruder can leverage to gain read and write access to configuration settings through the device's web administration interface, leading to a full host compromise.

Solution Description
--------------------
No patch is available at this time.

Tested Systems / Software (with versions)
------------------------------------------
Ubuntu Linux 9.10: Mozilla Firefox 3.5.9
Windows XP Professional Service Pack 3: Windows Internet Explorer 7.0.5730.13, Mozilla Firefox 3.6.3

Vendor Contact
--------------
Vendor Name: Adaptive Micro Systems Inc.
Vendor Website: http://www.adaptivedisplays.com/Default.asp