PT-2014-1969 · Seagate · Seagate Business Nas

Oj Reeves · Publicado 2014-10-07 · Atualizado 2017-06-16 · CVE-2014-8687

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Seagate Business NAS devices with firmware before 2015.00322

Description The issue is caused by the use of defective or risky cryptographic algorithms in the embedded software of Business NAS devices, allowing remote attackers to execute arbitrary code with root privileges. This is achieved by leveraging the use of a static encryption key to create session tokens.

Recommendations For Seagate Business NAS devices with firmware before 2015.00322, update the firmware to version 2015.00322 or later to resolve the issue.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

BDU:2017-01860

CVE-2014-8687

Produtos afetados

Seagate Business Nas

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb · Exploit
• 🔥 https://exploit-db.com/exploits/36264 · Exploit
• 🔥 https://exploit-db.com/exploits/36202 · Exploit
• 🔥 http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/130585/Seagate-Business-NAS-2014.00319-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8687 · Nota de Segurança
• http://securityfocus.com/bid/72831 · Nota
• https://beyondbinary.io/articles/seagate-nas-rce · Nota
• https://bdu.fstec.ru/vul/2017-01860 · Nota de Segurança