----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
https://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Lantronix SecureLinx SLC Console Manager File Download Vulnerability

SECUNIA ADVISORY ID:
SA15979

VERIFY ADVISORY:
https://secunia.com/advisories/15979/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information

WHERE:
>From remote

OPERATING SYSTEM:
Lantronix SecureLinx SLC
https://secunia.com/product/5345/

DESCRIPTION:
Dirk Wetter has reported a vulnerability in SLC console manager,
which can be exploited by malicious people to gain knowledge of
sensitive information.

The vulnerability is caused due to the built-in mini-httpd server
allowing ssh private key files and log files stored in subdirectories
under the web root to be retrieved. This can be exploited to gain
knowledge of the ssh private key and the information recorded in the
log files.

The vulnerability has been reported in SLC32, firmware version 2.0
and 3.0. Other models in the SLC series may also be affected.

SOLUTION:
The vendor is reportedly to be working on firmware version 3.1, which
will be released in August.

Filter incoming traffic and allow only trusted IP addresses to
connect to the device.

PROVIDED AND/OR DISCOVERED BY:
Dirk Wetter

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
https://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
https://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------