PT-2007-4511 · Ibm · Ibm Totalstorage Ds400

Published 2007-06-15 · Updated 2017-07-29 · CVE-2007-3232

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM TotalStorage DS400 with firmware 4.15

Description: The issue concerns the use of blank passwords for multiple accounts, including root, user, manager, administrator, and operator. This allows remote attackers to gain login access through certain Linux daemons. Specifically, a telnet daemon is accessible on a nonstandard port, tcp/6000.

Recommendations: For IBM TotalStorage DS400 with firmware 4.15, change the passwords for the root, user, manager, administrator, and operator accounts to secure ones to prevent unauthorized access. As a temporary workaround, consider disabling the telnet daemon on port tcp/6000 until a more secure configuration can be implemented. Restrict access to the device to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3232

Affected Products

Ibm Totalstorage Ds400

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-3232 · Security Note
• http://securityfocus.com/bid/24452 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34967 · Note
• http://osvdb.org/41610 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0244.html · Note