March Networks 3204 DVR Information Disclosure Vulnerability

Bugtraq ID:	27054
Class:	Access Validation Error
CVE:	CVE-2007-6638
Remote:	Yes
Local:	No
Published:	Dec 28 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	Alex Hernandez discovered this issue.
Vulnerable:	March Networks 3204 DVR 0
Not Vulnerable:

March Networks 3204 DVR Information Disclosure Vulnerability

March Networks 3204 Digital Video Recorder (DVR) is prone to an information-disclosure vulnerability.

Reports indicate that access to the logfiles is not restricted.

A successful exploit may allow attackers to obtain sensitive information that may aid in further attacks.

March Networks 3204 DVR Information Disclosure Vulnerability

An attacker can use a browser to carry out this attack.

A proof of concept is available.

• /data/vulnerabilities/exploits/27054.pl

March Networks 3204 DVR Information Disclosure Vulnerability

Solution:
Reports indicate that the vendor has addressed this issue, but Symantec could not confirm this information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

March Networks 3204 DVR Information Disclosure Vulnerability

References:

• Product Homepage (March Networks)
  
• SYBSEC-04.DEC.2007 - March Networks DVR 3204 Logfile Information Disclosure (SYB Security)