Vulnerability DreamBox DM500(+)

[sad723]

salam;

pour les utilisateurs de DreamBox DM500, DM500+, DM500HD and DM500S, elle souffre d'une vulnerablité de type "Arbitrary File Download Vulnerability".

 

DreamBox DM500(+) Arbitrary File Download Vulnerability

 

 

Vendor: Dream Multimedia GmbH

Product web page: http://www.dream-multimedia-tv.de

Affected version: DM500, DM500+, DM500HD and DM500S

 

Summary: The Dreambox is a series of Linux-powered

DVB satellite, terrestrial and cable digital television

receivers (set-top box).

 

Desc: Dreambox suffers from a file download vulnerability

thru directory traversal with appending the '/' character

in the HTTP GET method of the affected host address. The

attacker can get to sensitive information like paid channel

keys, usernames, passwords, config and plug-ins info, etc.

 

source

[Zving]

tester en local marche pas ou bien jai pas compris la manière de l'utiliser.

 

@++

[sad723]

tester en local marche pas ou bien jai pas compris la manière de l'utiliser.

 

@++

regarde en bas dans la source tu trouve des exemples pour tester

[ouedkniss]

fake alerte !