CVE-2009-3278

Опубликовано: 21 сент. 2009

Источник: nvd

CVSS3: 5.5

CVSS2: 4.9

EPSS Низкий

Описание

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack.

Ссылки

http://secunia.com/advisories/36793
Broken Link
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt
Exploit
http://www.securityfocus.com/archive/1/506607/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/36467
Broken Link
Third Party Advisory
VDB Entry
http://secunia.com/advisories/36793
Broken Link
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt
Exploit
http://www.securityfocus.com/archive/1/506607/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/36467
Broken Link
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:qnap:ts-239_pro_firmware:2.1.7:build0613:*:*:*:*:*:*

cpe:2.3:o:qnap:ts-239_pro_firmware:3.1.0:build0627:*:*:*:*:*:*

cpe:2.3:o:qnap:ts-239_pro_firmware:3.1.1:build0815:*:*:*:*:*:*

cpe:2.3:h:qnap:ts-239_pro:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

Одно из

cpe:2.3:o:qnap:ts-639_pro_firmware:2.1.7:build0613:*:*:*:*:*:*

cpe:2.3:o:qnap:ts-639_pro_firmware:3.1.0:build0627:*:*:*:*:*:*

cpe:2.3:o:qnap:ts-639_pro_firmware:3.1.1:build0815:*:*:*:*:*:*

cpe:2.3:h:qnap:ts-639_pro:-:*:*:*:*:*:*:*

EPSS

Процентиль: 23%

0.00074

Низкий

5.5 Medium

CVSS3

4.9 Medium

CVSS2

Дефекты

CWE-338

Связанные уязвимости

GHSA-qx3r-xm4v-rgrh