Description
The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day, which allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce.
References
- 28085 vdb-entry
- 20080303 Airscanner Mobile Security Advisory #07122001: Eye-Fi Multiple Vulnerabilities mailing-list
- 29221 third-party-advisory
- 42719 vdb-entry
- http://www.informit.com/articles/article.aspx?p=1177111&seqNum=2