PT-2007-4511 · Ibm · Ibm Totalstorage Ds400

Publicado 2007-06-15 · Atualizado 2017-07-29 · CVE-2007-3232

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM TotalStorage DS400 with firmware 4.15

Description: The issue concerns the use of blank passwords for multiple accounts, including root, user, manager, administrator, and operator. This allows remote attackers to gain login access through certain Linux daemons. Specifically, a telnet daemon is accessible on a nonstandard port, tcp/6000.

Recommendations: For IBM TotalStorage DS400 with firmware 4.15, change the passwords for the root, user, manager, administrator, and operator accounts to secure ones to prevent unauthorized access. As a temporary workaround, consider disabling the telnet daemon on port tcp/6000 until a more secure configuration can be implemented. Restrict access to the device to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-3232

Produtos afetados

Ibm Totalstorage Ds400

Referências · 5

• http://securityfocus.com/bid/24452 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34967 · Nota
• http://osvdb.org/41610 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3232 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0244.html · Nota