bugtraq - [CVE-2013-2751, CVE-2013-2752] NETGEAR ReadyNAS Remote Root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAJPzsLNBe44N_MgJgbU+5WSu_WjW1Vc0PcX7SenJeQ57PZ8NKQ@mail.gmail.com>
Date: Tue, 22 Oct 2013 09:33:35 -0400
From: Craig Young <vuln-report@...ur3.us>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
  webappsec@...urityfocus.com
Subject: [CVE-2013-2751, CVE-2013-2752] NETGEAR ReadyNAS Remote Root

NETGEAR ReadyNAS with firmware 4.2.x before 4.2.24 and 4.1.x before
4.1.12 is prone to command injection from an unauthenticated HTTP GET
request.  This vulnerability can lead to complete root access as
outlined on the Tripwire blog:
http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/

If you have not already, I strongly advise all ReadyNAS administrators
to apply the latest firmware.  (With some help from Shodan, I estimate
that nearly 75% of Internet facing ReadyNAS have not been updated.)
Please join me Tuesday October 29 at 1PM EST for a Google Hangout in
which I will discuss the issue further and demonstrate a technique for
exploiting the flaw.

Thanks,
Craig Young
@CraigTweets
http://secur3.us/pub_key.asc