Emerson Network Power Avocent MergePoint Unity 2016 KVM目录遍历漏洞

发布日期：2014-01-23
更新日期：2014-01-27受影响系统：
emersonnetworkpower Avocent MergePoint Unity 1.9.16473
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 65105
CVE（CAN） ID: CVE-2013-6030MergePoint Unity交换机是下一代KVM，可以远程管理数据中心和分支机构。Emerson Network Power Avocent MergePoint Unity 2016 KVM（固件版本1.9.16473）在实现上存在目录遍历漏洞，可使远程攻击者下载关键文件，例如/etc/passwd，读取任意文件，获取设备的凭证。<*来源：Shady Liu

链接：http://www.kb.cert.org/vuls/id/168751
*>建议：
--------------------------------------------------------------------------------
临时解决方法：限制访问MPU2016 KVM交换机Web接口。厂商补丁：emersonnetworkpower
-------------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：http://www.emersonnetworkpower.com/en-US/Products/InfrastructureManagement/DigitalKVMAppliances/Page参考:http://www.emersonnetworkpower.com/en-US/Products/InfrastructureManagement/DigitalKVMAppliances/Pages/AvocentMergePointUnityAppliances.aspx
http://www.avocent.com/Support_Firmware/MergePoint_Unity/MergePoint_Unity_Switch.aspx
http://cwe.mitre.org/data/definitions/23.html
http://www.avocent.com/Support_Firmware/MergePoint_Unity/MergePoint_Unity_Switch_-_Previous_Releases.aspxOpenStack Compute （Nova）信息泄露漏洞（CVE-2013-7130）PizzaInn_Project "reserve-exec.php" SQL注入漏洞相关资讯 MergePoint Unity 本文评论查看全部评论（0）

评论声明