Web Application Security
[CVE-2013-2751, CVE-2013-2752] NETGEAR ReadyNAS Remote Root Oct 22 2013 01:33PM
Craig Young (vuln-report secur3 us)
NETGEAR ReadyNAS with firmware 4.2.x before 4.2.24 and 4.1.x before
4.1.12 is prone to command injection from an unauthenticated HTTP GET
request. This vulnerability can lead to complete root access as
outlined on the Tripwire blog:
http://www.tripwire.com/state-of-security/vulnerability-management/ready
nas-flaw-allows-root-access-unauthenticated-http-request/

If you have not already, I strongly advise all ReadyNAS administrators
to apply the latest firmware. (With some help from Shodan, I estimate
that nearly 75% of Internet facing ReadyNAS have not been updated.)
Please join me Tuesday October 29 at 1PM EST for a Google Hangout in
which I will discuss the issue further and demonstrate a technique for
exploiting the flaw.

Thanks,
Craig Young
@CraigTweets
http://secur3.us/pub_key.asc

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus