CNVD-2017-00110

Vulnerability from cnvd - Published: 2017-01-05
VLAI
Title
NETGEAR多个产品目录遍历漏洞
Description
NETGEAR是美国网件公司，是一家电脑网络设备及其他电脑硬件厂商。 NETGEAR FVS336Gv3，FVS318N，FVS318Gv2，SRX5308设备4.3.3-8之前版本的固件，在scgi-bin/platform.cgi中存在目录遍历漏洞，可使远程用户通过thispage参数内的“..”，读取任意文件。
Severity
中
Patch Name
NETGEAR多个产品目录遍历漏洞的补丁
Patch Description
NETGEAR是美国网件公司，是一家电脑网络设备及其他电脑硬件厂商。 NETGEAR FVS336Gv3，FVS318N，FVS318Gv2，SRX5308设备4.3.3-8之前版本的固件，在scgi-bin/platform.cgi中存在目录遍历漏洞，可使远程用户通过thispage参数内的“..”，读取任意文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

用户可联系供应商获得补丁信息： http://kb.netgear.com/30739/Path-Traversal-Attack-Security-Vulnerability

Reference
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10106
Impacted products
Name
['NETGEAR FVS336Gv3 <=4.3-3.6', 'NETGEAR FVS318N <=4.3-3.6', 'NETGEAR FVS318Gv2 <=4.3-3.6', 'NETGEAR SRX5308 <=4.3-3.6']
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "95204"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-10106"
    }
  },
  "description": "NETGEAR\u662f\u7f8e\u56fd\u7f51\u4ef6\u516c\u53f8\uff0c\u662f\u4e00\u5bb6\u7535\u8111\u7f51\u7edc\u8bbe\u5907\u53ca\u5176\u4ed6\u7535\u8111\u786c\u4ef6\u5382\u5546\u3002\r\n\r\nNETGEAR FVS336Gv3\uff0cFVS318N\uff0cFVS318Gv2\uff0cSRX5308\u8bbe\u59074.3.3-8\u4e4b\u524d\u7248\u672c\u7684\u56fa\u4ef6\uff0c\u5728scgi-bin/platform.cgi\u4e2d\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u53ef\u4f7f\u8fdc\u7a0b\u7528\u6237\u901a\u8fc7thispage\u53c2\u6570\u5185\u7684\u201c..\u201d\uff0c\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u3002",
  "discovererName": "NETGEAR",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://kb.netgear.com/30739/Path-Traversal-Attack-Security-Vulnerability",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-00110",
  "openTime": "2017-01-05",
  "patchDescription": "NETGEAR\u662f\u7f8e\u56fd\u7f51\u4ef6\u516c\u53f8\uff0c\u662f\u4e00\u5bb6\u7535\u8111\u7f51\u7edc\u8bbe\u5907\u53ca\u5176\u4ed6\u7535\u8111\u786c\u4ef6\u5382\u5546\u3002\r\n\r\nNETGEAR FVS336Gv3\uff0cFVS318N\uff0cFVS318Gv2\uff0cSRX5308\u8bbe\u59074.3.3-8\u4e4b\u524d\u7248\u672c\u7684\u56fa\u4ef6\uff0c\u5728scgi-bin/platform.cgi\u4e2d\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u53ef\u4f7f\u8fdc\u7a0b\u7528\u6237\u901a\u8fc7thispage\u53c2\u6570\u5185\u7684\u201c..\u201d\uff0c\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "NETGEAR\u591a\u4e2a\u4ea7\u54c1\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NETGEAR FVS336Gv3 \u003c=4.3-3.6",
      "NETGEAR FVS318N \u003c=4.3-3.6",
      "NETGEAR FVS318Gv2 \u003c=4.3-3.6",
      "NETGEAR SRX5308 \u003c=4.3-3.6"
    ]
  },
  "referenceLink": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10106",
  "serverity": "\u4e2d",
  "submitTime": "2017-01-04",
  "title": "NETGEAR\u591a\u4e2a\u4ea7\u54c1\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.