| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 15 Jun 2016 20:40:17 +0000 From: Karn Ganeshen <karnganeshen@...il.com> To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org> Subject: [FD] HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities *HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities* *Confirmed on firmware version 4.10* *HPE PSRT response*: Upgrade to MSL6480 is 4.90 (current version) *Weak Credentials Management* The device comes with weak, default login credentials - security/security - and the application does not enforce a mandatory, password change from default to strong password values. *Access Control Issues* An unauthenticated user can download system configuration archive. Archive Filename can be guessed with a bit of scripting. Filename format is as follows: /syslog-MSL6480-A60A80-<v.er>-YYYY-MM-DD_HH-MM-SS-SSS_<AM_or_PM>.zip For example, anyone can download the config by requesting the url: http://IP/tmp/syslog-MSL6480-A60A80-4.10-2016-06-15_01-01-01-001_PM.zip *Vulnerable to Cross-Site Request Forgery* There is no CSRF Token generated per page and / or per (sensitive) function. Successful exploitation of this vulnerability may allow silent execution of unauthorized actions on the device such as password change, configuration parameter changes, generating system configuration archive, saving modified configuration, & device reboot. +++++ -- Best Regards, Karn Ganeshen _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists