|
LogMeIn Cross-Site Request Forgery Vulnerability
|
|
Secunia Advisory:
|
SA34934
|
|
|
Release Date:
|
2009-06-02
|
|
Last Update:
|
2009-07-08
|
|
Popularity:
|
917 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Cross Site Scripting
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | LogMeIn 4.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 2 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Solution:
The vendor states that a fix is scheduled for the next release in July.
In the meantime, the vendor recommends one of the following:
* "Before opening the local web interface, users should close all other browser windows and tabs. When finished with the local LogMeIn interface, users should click Log Out or Disconnect."
* "If the above is not feasible, do not access the local web interface. All settings and options available from the local web interface are also available via logins through the logmein.com website, and that is not at risk from CSRF."
Provided and/or discovered by:
Inferno
Changelog:
2009-06-03: Updated "Description" section and added link to "Original Advisory" section.
2009-06-05: Updated "Description" and "Solution" section with new information provided by the vendor.
2009-07-08: Added additional information from the vendor in the "Solution" section.
Original Advisory:
Inferno:
http://securethoughts.com/2009/06/mul...ur-computer-and-steal-arbitary-files/
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
