Eye-Fi Multiple Security Vulnerabilities

Bugtraq ID:	28085
Class:	Unknown
CVE:	CVE-2008-7138 CVE-2008-7139 CVE-2008-7137
Remote:	Yes
Local:	No
Published:	Mar 03 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	Seth Fogie is credited with discovering these vulnerabilities.
Vulnerable:	Eye-Fi Eye-Fi 1.1.2
Not Vulnerable:

Eye-Fi Multiple Security Vulnerabilities

The Eye-Fi Manager and Card are prone to multiple security vulnerabilities, including unauthorized image uploads to computers, remotely altering the destination folder, cross-site request-forgery vulnerabilities, and a denial-of-service vulnerability.

These issues affect Eye-Fi 1.1.2; other versions may also be affected.

Eye-Fi Multiple Security Vulnerabilities

To exploit a cross-site request-forgery issue, an attacker must entice an unsuspecting victim into visiting a malicious URI.

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Eye-Fi Multiple Security Vulnerabilities

Solution:
The vendor has released upgrades to address these issues. Please contact the vendor for information on obtaining and applying the patches.

Eye-Fi Multiple Security Vulnerabilities

References:

• Eye-Fi Homepage (Eye-Fi)
  
• The Eye-Fi: A Case Study in Next-Generation Application Security Issues (InformIT Network)
  
• Airscanner Mobile Security Advisory #07122001: Eye-Fi Multiple Vulnerabilities (Seth Fogie )