PT-2005-4137 · Network Appliance · Data Ontap

Thomas H. Ptacek · Published 2005-10-27 · Updated 2016-10-18 · CVE-2005-3327

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Network Appliance Data ONTAP versions 7.0 and earlier

Description The issue allows iSCSI Initiators to bypass iSCSI authentication by using a modified client. This client skips the Security (Start) mode, as required by the Login Negotiation protocol, and uses Operational mode without proving identity.

Recommendations For versions 7.0 and earlier, consider restricting access to iSCSI Initiators to minimize the risk of exploitation until a fix is available.

Fix

Related Identifiers

CVE-2005-3327

Affected Products

Data Ontap

References · 7

• http://secunia.com/advisories/17321 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-3327 · Security Note
• http://securityfocus.com/bid/15197 · Note
• http://marc.info/?l=bugtraq&m=113028385702680&w=2 · Note
• http://securitytracker.com/id?1015103 · Note
• http://matasano.com/advisories/netapp-iSCSI.txt · Note
• http://vupen.com/english/advisories/2005/2193 · Note