PT-2014-6487 · Qnap · Qnap Ts-Ec1679U-Rp+3

David Kennedy + 3 · Publicado 2014-08-25 · Atualizado 2014-08-26 · CVE-2014-5457

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNAP TS-469U version 4.0.7 Build 20140410 QNAP TS-459U (affected versions not specified) QNAP TS-EC1679U-RP (affected versions not specified) QNAP SS-839 (affected versions not specified)

Description The issue allows local users to obtain usernames and hashed passwords by reading the password file due to world-readable permissions for /etc/config/shadow.

Recommendations For QNAP TS-469U version 4.0.7 Build 20140410, consider changing the permissions of /etc/config/shadow to restrict access. For QNAP TS-459U, TS-EC1679U-RP, and SS-839, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-5457

Produtos afetados

Qnap Ss-839

Qnap Ts-459U

Qnap Ts-469U

Qnap Ts-Ec1679U-Rp

Referências · 5

• http://seclists.org/fulldisclosure/2014/Jul/59 · Nota
• http://seclists.org/fulldisclosure/2014/Jul/61 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5457 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Jul/58 · Nota
• http://seclists.org/fulldisclosure/2014/Jul/57 · Nota