Full Disclosure: CVE-2014-1610 description incorrect

[Brandon Perry <bperry.volatile () gmail com>]

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1610

It states that authentication is required to exploit this and this is not
true.

What does require authentication usually is uploading the file. If there is
already a djvu file that has been uploaded by another user, you do not need
authentication to exploit this.

https://gist.github.com/brandonprry/8746891

I believe this should be revised as the exploit itself does not require
authentication. I think that will also result in a score change as well.



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/