PT-2009-6531 · Internet Initiative Japan · Seil/B1

Published 2009-12-23 · Updated 2010-01-06 · CVE-2009-4409

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Internet Initiative Japan SEIL/B1 firmware versions 1.00 through 2.52

Description The issue concerns the PPP Access Concentrator function in the firmware, specifically the CHAP and MS-CHAP-V2 authentication capabilities. These capabilities use the same challenge for each authentication attempt, allowing remote attackers to bypass authentication via a replay attack.

Recommendations For versions 1.00 through 2.52, consider disabling the CHAP and MS-CHAP-V2 authentication capabilities until a patch is available. Restrict access to the PPP Access Concentrator function to minimize the risk of exploitation. Avoid using the same challenge for each authentication attempt to prevent replay attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-4409

Affected Products

Seil/B1

References · 7

• http://seil.jp/seilseries/security/2009/a00697.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4409 · Security Note
• http://secunia.com/advisories/37628 · Vendor Advisory
• http://securityfocus.com/bid/37293 · Note
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000079.html · Note
• http://osvdb.org/61118 · Note
• http://jvn.jp/en/jp/JVN49602378/index.html · Note