36357 : Infrant ReadyNAS Default Root Password Generation Weakness
Printer | http://osvdb.org/36357 | Email This | Edit Vulnerability

Views This Week
9

Views All Time
1087

Info

Last Modified
about 1 year ago

Percent Complete
100%

Disclosure
Aug 06, 2007

Discovery
Jul 25, 2007

Dates

Exploit
Unknown

Solution
Unknown

Keywords

 No Keywords

Description

 By default, Infrant ReadyNAS RAIDiator boots with a default root password. This password is generated by a known algorithm using MAC Address, software version, and shared secret. With this knowledge, an attacker can easily guess the default password and access all data remotely on a ReadyNAS.

Classification

 Location: Remote/Network Access Required
Attack Type: Authentication Management
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Solution

 Upgrade to version 4.0 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): installation of "ToggleSSH" addon from Infrant.

Products
Infrant
Watch-list
ReadyNAS RAIDiator
Watch-list
 3.x

References

Credit
  • Brian Chapados - brian_at_chapados.org -
  • Felix Domke - tmbinc_at_elitedvb.net -

Blogs

Provided by Technorati

2007/08/15 00:00:00 | CVE-2007-4361

from: National Vulnerability Database

CVE-2007-4361 Publish Date: 8/15/2007 NETGEAR (formerly Infrant) ReadyNAS RAIDiator before 4.00b2-p2-T1 beta creates a default SSH root password derived from the hardware serial number, which

2007/08/16 19:34:58 | CVE-2007-4361 (ReadyNAS RAIDiator)

from: VulnAware.com

NETGEAR (formerly Infrant) ReadyNAS RAIDiator before 4.00b2-p2-T1 beta creates a default SSH root password derived from the hardware serial number, which makes it easier for remote attackers to guess the password and obtain login access.

Comments

Add Comment

No Comments.

DONATE NOW!

User Status

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use