PT-2005-4137 · Network Appliance · Data Ontap

Thomas H. Ptacek · Publicado 2005-10-27 · Atualizado 2016-10-18 · CVE-2005-3327

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Network Appliance Data ONTAP versions 7.0 and earlier

Description The issue allows iSCSI Initiators to bypass iSCSI authentication by using a modified client. This client skips the Security (Start) mode, as required by the Login Negotiation protocol, and uses Operational mode without proving identity.

Recommendations For versions 7.0 and earlier, consider restricting access to iSCSI Initiators to minimize the risk of exploitation until a fix is available.

Correção

Identificadores relacionados

CVE-2005-3327

Produtos afetados

Data Ontap

Referências · 7

• http://securityfocus.com/bid/15197 · Nota
• http://marc.info/?l=bugtraq&m=113028385702680&w=2 · Nota
• http://secunia.com/advisories/17321 · Correção
• http://securitytracker.com/id?1015103 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3327 · Nota de Segurança
• http://matasano.com/advisories/netapp-iSCSI.txt · Nota
• http://vupen.com/english/advisories/2005/2193 · Nota