Test Kennung:	1.3.6.1.4.1.25623.1.0.805970
Kategorie:	General
Titel:	pfSense Multiple Vulnerabilities - 01 Sep15
Zusammenfassung:	This host is running pfSense and is prone; to multiple vulnerabilities.
Beschreibung:	Summary: This host is running pfSense and is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - Input passed via 'the starttime0' parameter to firewall_schedule.php, the 'rssfeed' parameter to rss.widget.php, the 'servicestatusfilter' parameter to services_status.widget.php, the 'txtRecallBuffer' parameter to exec.php and the HTTP Referer header to log.widget.php is not proper validated and encoded. - Input passed via POST request on diag_dns.php script during the 'Create Alias' action is not properly validated or sanitized. - Input passed via 'update e-mail' function on the diag_smart.php page is not properly validated or sanitized. - The database value passed to status_rrd_graph_img.php script is not properly validated or sanitized. - An error in pkg_edit.php which allows including XML files. - Errors in pkg_mgr_install.php and system_firmware_restorefullbackup.php scripts. - The session ID is not properly reset when initializing a new login session. - The session cookie set at login does not have the HttpOnly flag set when the firewall's GUI is configured to use HTTP. Vulnerability Impact: Successful exploitation will allow remote attackers to hijack users session, gain access to sensitive files, execute arbitrary HTML and script code in a user's browser session in the context of an affected site and get elevated privileges, read arbitrary files, execute commands, or have other impact on the system. Affected Software/OS: pfSense before version 2.1.4 Solution: Upgrade to version 2.1.4 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2014-4687 Common Vulnerability Exposure (CVE) ID: CVE-2014-4688 https://www.exploit-db.com/exploits/43560/ Common Vulnerability Exposure (CVE) ID: CVE-2014-4689 Common Vulnerability Exposure (CVE) ID: CVE-2014-4690 Common Vulnerability Exposure (CVE) ID: CVE-2014-4691 Common Vulnerability Exposure (CVE) ID: CVE-2014-4692
Copyright	This script is Copyright (C) 2015 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.