PT-2009-6531 · Internet Initiative Japan · Seil/B1

Publicado 2009-12-23 · Atualizado 2010-01-06 · CVE-2009-4409

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Internet Initiative Japan SEIL/B1 firmware versions 1.00 through 2.52

Description The issue concerns the PPP Access Concentrator function in the firmware, specifically the CHAP and MS-CHAP-V2 authentication capabilities. These capabilities use the same challenge for each authentication attempt, allowing remote attackers to bypass authentication via a replay attack.

Recommendations For versions 1.00 through 2.52, consider disabling the CHAP and MS-CHAP-V2 authentication capabilities until a patch is available. Restrict access to the PPP Access Concentrator function to minimize the risk of exploitation. Avoid using the same challenge for each authentication attempt to prevent replay attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-4409

Produtos afetados

Seil/B1

Referências · 7

• http://seil.jp/seilseries/security/2009/a00697.php · Aviso do Fabricante
• http://securityfocus.com/bid/37293 · Nota
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000079.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4409 · Nota de Segurança
• http://osvdb.org/61118 · Nota
• http://secunia.com/advisories/37628 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN49602378/index.html · Nota