Re: [Full-disclosure] Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Subject: Re: [Full-disclosure] Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker
From: Adam Baldwin <adam_baldwin@xxxxxxxxxxxxxxx>
Date: Sat, 16 Jan 2010 09:09:43 -0800
Cc: full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
In-reply-to: <26d709761001160813y11b3e5b7jea4e8f4140f68571@xxxxxxxxxxxxxx>
User-agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0

On 1/16/10 8:13 AM, A. Ramos wrote:
> Hello all,
>
> Just another one: you can access to the configuration backup without
> authentication at: /config.xml.sav
If you have the Sprint MiFi with the latest firmware rev (AP 11.47.17
Router 018.0101) The correct path is
/config.xml.savefile

-Adam

References:
- Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker
  - From: Adam Baldwin
- Re: [Full-disclosure] Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker
  - From: A. Ramos

Prev by Date: Code to mitigate IE event zero-day (CVE-2010-0249)
Next by Date: [USN-885-1] LibThai vulnerability
Previous by thread: Re: [Full-disclosure] Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker
Next by thread: rPSA-2010-0004-1 openssl openssl-scripts
Index(es):
- Date
- Thread

[Index of Archives] [Linux Security] [Netfilter] [PHP] [Yosemite News] [Linux Kernel]

Powered by Linux