Ditto Forensic FieldStation Multiple Security Vulnerabilities
BID:64331
Info
Ditto Forensic FieldStation Multiple Security Vulnerabilities
| Bugtraq ID: | 64331 |
| Class: | Unknown |
| CVE: |
CVE-2013-6881 CVE-2013-6882 CVE-2013-6883 CVE-2013-6884 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 13 2013 12:00AM |
| Updated: | Dec 13 2013 12:00AM |
| Credit: | Martin Wundram |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Ditto Forensic FieldStation Multiple Security Vulnerabilities
Ditto Forensic FieldStation is prone to multiple html-injection vulnerabilities, an unspecified cross-site request-forgery vulnerability, multiple remote command-injection vulnerabilities and an authentication-bypass vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, disclose sensitive information, perform certain administrative actions, gain unauthorized access, or bypass certain security restrictions.
Ditto Forensic FieldStation is prone to multiple html-injection vulnerabilities, an unspecified cross-site request-forgery vulnerability, multiple remote command-injection vulnerabilities and an authentication-bypass vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, disclose sensitive information, perform certain administrative actions, gain unauthorized access, or bypass certain security restrictions.
Exploit / POC
Ditto Forensic FieldStation Multiple Security Vulnerabilities
An attacker can use a web browser to exploit some of these issues.
To exploit cross-site request forgery vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
An attacker can use readily available tools to exploit the authentication bypass issue.
An attacker can use a web browser to exploit some of these issues.
To exploit cross-site request forgery vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
An attacker can use readily available tools to exploit the authentication bypass issue.
Solution / Fix
Ditto Forensic FieldStation Multiple Security Vulnerabilities
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
References
Ditto Forensic FieldStation Multiple Security Vulnerabilities
References:
References: