Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Thecus NAS Server N8800 contains multiple vulnerabilities
Informations
Name VU#105686 First vendor Publication 2014-01-23
Vendor VU-CERT Last vendor Modification 2014-02-10
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#105686

Thecus NAS Server N8800 contains multiple vulnerabilities

Original Release date: 23 Jan 2014 | Last revised: 10 Feb 2014

Overview

Thecus NAS server N8800 with firmware version 5.03.01, and possibly earlier versions, contains multiple vulnerabilities.

Description

The 7 Elements advisory states that the Thecus NAS server N8800 device contains the following vulnerabilities:

CVE-2013-5667 - Thecus NAS Server N8800 Firmware 5.03.01 get_userid OS Command Injection
The application accepts user input through the get_userid parameter that can be used to create OS commands that are redirected to the operating system. An attacker can use this flaw to execute arbitrary commands.

CVE-2013-5668 - Thecus NAS Server N8800 Firmware 5.03.01
The Domain Administrator Password within the ADS/NT Support page is disclosed due to clear text storage of sensitive information within the GUI. Any user who has access to this page is able to retrieve the ADS/NT administrator ID and password. This could enable an attacker to gain access to the domain hosting the storage server.

CVE-2013-5669 - Thecus NAS Server N8800 Firmware 5.03.01 plain text administrative password
The Administration Web Page transmits passwords in cleartext, which allows remote attackers to sniff the administrative password.

Additional details may be found in the 7 Elements advisory. The CVSS score below is for CVE-2013-5667.

Impact

An attacker may be able to execute arbitrary system commands, steal the Domain Administrator credentials, or sniff administrative passwords.

Solution

Apply an Update

The vendor has released the following firmware updates to address these vulnerabilities.

ThecusOS 5 (32 bit):
http://www.thecus.com/Downloads/beta/FW/Thecus_NAS_FW_beta_5.03.02.4.rom

ThecusOS 5 (64 bit):
http://www.thecus.com/Downloads/beta/FW/64_V2.04.05_build7464_FW_N2800_N4510U_N4800_N5550_N7510.rom
http://www.thecus.com/Downloads/beta/FW/64_V2.04.05_build7464_FW_N6850_N8850_N10850_N8900_N12000_N16000.rom
http://www.thecus.com/Downloads/beta/FW/64_V2.04.05_build7464_FW_N7700PROV2_N8800PROV2.rom

The vendor claims firmware updates for ThecusOS 6 will be available in a month. If you are unable to upgrade, please consider the following workarounds.

Restrict Access

Enable firewall rules to restrict access from untrusted sources.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Thecus TechAffected27 Nov 201323 Jan 2014
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base10.0AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal9.5E:F/RL:U/RC:C
Environmental2.4CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

  • http://www.thecus.com/
  • http://www.7elements.co.uk/news/cve-2013-5667
  • http://www.7elements.co.uk/news/cve-2013-5668
  • http://www.7elements.co.uk/news/cve-2013-5669
  • http://www.7elements.co.uk/resources/blog/multiple-vulnerabilities-thecus-nas/

Credit

Thanks to David Stubley for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs:CVE-2013-5667CVE-2013-5668CVE-2013-5669
  • Date Public:23 Jan 2014
  • Date First Published:23 Jan 2014
  • Date Last Updated:10 Feb 2014
  • Document Revision:14

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/105686

CWE : Common Weakness Enumeration

% Id Name
67 % CWE-255 Credentials Management
33 % CWE-78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Hardware 1
Os 1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2014-02-10 21:20:25
  • Multiple Updates
2014-01-24 21:24:59
  • Multiple Updates
2014-01-24 13:23:39
  • Multiple Updates
2014-01-23 21:19:12
  • First insertion