| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <42d09113-0cc8-b482-537e-a77db8ec4f68@securify.nl> Date: Wed, 8 Feb 2017 19:02:54 +0100 From: "Securify B.V." <lists@...urify.nl> To: fulldisclosure@...lists.org Subject: [FD] Authentication bypass vulnerability in Western Digital My Cloud ------------------------------------------------------------------------ Authentication bypass vulnerability in Western Digital My Cloud ------------------------------------------------------------------------ Remco Vermeulen, Januari 2017 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ It was discovered that Western Digital My Cloud is affected by an authentication bypass vulnerability. By exploiting this vulnerability, an unauthenticated attacker can bypass the login functionality and gain full control of the device. ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This vulnerability was successfully verified on a Western Digital My Cloud model WDBCTL0020HWT running firmware version 2.21.119. This issue isn't limited to the model that was used to find this vulnerability since most of the products in the My Cloud series share the same (vulnerable) code. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ Western Digital has released firmware version 2.21.126 that resolves this vulnerability. This updated firmware can be downloaded from the following location: https://support.wdc.com/downloads.aspx?g=904&lang=en#firmware ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20170102/authentication_bypass_vulnerability_in_western_digital_my_cloud.html _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists