PT-2014-6487 · Qnap · Qnap Ts-Ec1679U-Rp+3

David Kennedy + 3 · Published 2014-08-25 · Updated 2014-08-26 · CVE-2014-5457

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNAP TS-469U version 4.0.7 Build 20140410 QNAP TS-459U (affected versions not specified) QNAP TS-EC1679U-RP (affected versions not specified) QNAP SS-839 (affected versions not specified)

Description The issue allows local users to obtain usernames and hashed passwords by reading the password file due to world-readable permissions for /etc/config/shadow.

Recommendations For QNAP TS-469U version 4.0.7 Build 20140410, consider changing the permissions of /etc/config/shadow to restrict access. For QNAP TS-459U, TS-EC1679U-RP, and SS-839, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-5457

Affected Products

Qnap Ss-839

Qnap Ts-459U

Qnap Ts-469U

Qnap Ts-Ec1679U-Rp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-5457 · Security Note
• http://seclists.org/fulldisclosure/2014/Jul/59 · Note
• http://seclists.org/fulldisclosure/2014/Jul/61 · Note
• http://seclists.org/fulldisclosure/2014/Jul/58 · Note
• http://seclists.org/fulldisclosure/2014/Jul/57 · Note