← Advisories

DreamBox DM500(+) Arbitrary File Download Vulnerability

Medium
Advisory ID
ZSL-2011-5013
Release Date
13 May 2011
Vendor
Dream Multimedia GmbH - http://www.dream-multimedia-tv.de
Affected Version
DM500, DM500+, DM500HD and DM500S
CVE
N/A
Tested On
Linux Kernel 2.6.9, The Gemini Project, Enigma
Summary

The Dreambox is a series of Linux-powered DVB satellite, terrestrial and cable digital television receivers (set-top box).

Description

Dreambox suffers from a file download vulnerability thru directory traversal with appending the '/' character in the HTTP GET method of the affected host address. The attacker can get to sensitive information like paid channel keys, usernames, passwords, config and plug-ins info, etc.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
13.05.2011Initial release
16.05.2011Added reference [4] and [5]
17.05.2011Added reference [6]
27.06.2011Added reference [7]