Western Digital Live TV Local File Include and Arbitrary File Upload Vulnerabilities

Bugtraq ID:	54193
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 25 2012 12:00AM
Updated:	Jun 25 2012 12:00AM
Credit:	Wolf Bee
Vulnerable:	Western Digital TV Live Hub 1.7.15 Western Digital TV Live 1.7.15
Not Vulnerable:

Western Digital Live TV Local File Include and Arbitrary File Upload Vulnerabilities

Western Digital Live TV is prone to a local file-include vulnerability and an arbitrary file-upload vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.

Western Digital Live TV 1.07.15 and prior are vulnerable.

Western Digital Live TV Local File Include and Arbitrary File Upload Vulnerabilities

The following exploit is available:

• /data/vulnerabilities/exploits/54193.txt

Western Digital Live TV Local File Include and Arbitrary File Upload Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Western Digital Live TV Local File Include and Arbitrary File Upload Vulnerabilities

References:

• Product Homepage (Western Digital)