National Cyber Awareness System

Vulnerability Summary for CVE-2010-2465

Overview

The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via unspecified HTTP requests.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Per: http://www.kb.cert.org/vuls/id/MAPG-83TQL8 'Vendor Statement S2 Security has made available patches or upgrades available to address this vulnerability in all versions of our product (2.5, 3.3, and 4.0). These are available through Linear Customer Support or S2 Customer Support'}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#251133

Name: VU#251133

Hyperlink:http://www.kb.cert.org/vuls/id/251133

External Source: MISC

Name: http://www.slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon

Hyperlink:http://www.slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon

External Source: MISC

Name: http://www.securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2

Hyperlink:http://www.securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2

External Source: BID

Name: 41134

Hyperlink:http://www.securityfocus.com/bid/41134

External Source: CONFIRM

Name: http://www.kb.cert.org/vuls/id/MAPG-83TQL8

Hyperlink:http://www.kb.cert.org/vuls/id/MAPG-83TQL8

External Source: MISC

Name: http://www.darkreading.com/blog/archives/2010/04/attacking_door.html

Hyperlink:http://www.darkreading.com/blog/archives/2010/04/attacking_door.html

External Source: SECUNIA

Name: 40374

Hyperlink:http://secunia.com/advisories/40374

External Source: OSVDB

Name: 65757

Hyperlink:http://osvdb.org/65757

External Source: MISC

Name: http://blip.tv/file/3414004

Hyperlink:http://blip.tv/file/3414004