Vulners
Lucene search
Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Read
🗓️ 13 Dec 2017 00:00:00Reported by Jakub PalaczynskiType 
packetstorm🔗 packetstormsecurity.com👁 35 Views
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read Vulnerability | 14 Dec 201700:00 | – | zdt |
| Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass Vulnerability | 14 Dec 201700:00 | – | zdt |
 | Meinberg LANTIME Web Arbitrary File Read Vulnerability | 18 Dec 201700:00 | – | cnvd |
 | CVE-2017-16787 | 15 Dec 201718:00 | – | cve |
 | CVE-2017-16787 | 15 Dec 201718:00 | – | cvelist |
 | Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read | 13 Dec 201700:00 | – | exploitdb |
 | EUVD-2017-7965 | 7 Oct 202500:30 | – | euvd |
 | Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read | 13 Dec 201700:00 | – | exploitpack |
 | CVE-2017-16787 | 15 Dec 201718:29 | – | nvd |
| Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass | 13 Dec 201700:00 | – | packetstorm |
10
`Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read
Author: Jakub Palaczynski
CVE: CVE-2017-16787
Exploit tested on:
==================
Meinberg LANTIME Web Configuration Utility 6.16.008
Vulnerability affects:
======================
All LTOS6 firmware releases before 6.24.004
Vulnerability:
**************
Arbitrary File Read:
====================
It is possible to read arbitrary file on the system with root permissions
Proof of Concept:
First instance:
https://host/cgi-bin/mainv2?value=800&showntpclientipinfo=xxx&ntpclientcounterlogfile=/etc/passwd&lcs=xxx
Info-User user is able to read any file on the system with root permissions.
Second instance:
User with Admin-User access is able to read any file on the system via
firmware update functionality. Curl accepts "file" schema which actually
downloads file from the filesystem. Then it is possible to download
/upload/update file which contains content of requested file.
Contact:
========
Jakub[dot]Palaczynski[at]gmail[dot]com
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Dec 2017 00:00Current
EPSS0.09187