Full Disclosure mailing list archives
CVE-2014-1610 description incorrect
From: Brandon Perry <bperry.volatile () gmail com>
Date: Fri, 31 Jan 2014 20:12:47 -0600
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1610 It states that authentication is required to exploit this and this is not true. What does require authentication usually is uploading the file. If there is already a djvu file that has been uploaded by another user, you do not need authentication to exploit this. https://gist.github.com/brandonprry/8746891 I believe this should be revised as the exploit itself does not require authentication. I think that will also result in a score change as well. -- http://volatile-minds.blogspot.com -- blog http://www.volatileminds.net -- website
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- CVE-2014-1610 description incorrect Brandon Perry (Feb 02)