ID de Prueba:	1.3.6.1.4.1.25623.1.0.103822
Categoría:	Web application abuses
Título:	NetGear RAIDiator (ReadyNAS) CSRF And Command Injection Vulnerabilities (Oct 2013) - Active Check
Resumen:	NetGear RAIDiator is prone to a cross-site request forgery; (CSRF) vulnerability and a command injection vulnerability.
Descripción:	Summary: NetGear RAIDiator is prone to a cross-site request forgery (CSRF) vulnerability and a command injection vulnerability. Vulnerability Insight: The NETGEAR ReadyNAS RAIDiator firmware prior to the 4.2.24 release is prone to remote command execution through the FrontView web interface. An attacker can use an unauthenticated HTTP GET request to execute arbitrary commands as user 'admin' on the remote NAS device. This vulnerability exists due to a failure in /frontview/lib/np_handler.pl to sanitize user-input. Due to various improper file system permissions, the admin user can execute commands as root. Vulnerability Impact: Exploiting these issues may allow a remote attacker to perform certain administrative actions and execute arbitrary shell commands with root privileges. Other attacks are also possible. Affected Software/OS: The following versions are vulnerable: - RAIDiator versions prior to 4.1.12 running on SPARC - RAIDiator-x86 versions prior to 4.2.24 Solution: Updates are available. Please see the references or vendor advisory for more information. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-2751 http://www.exploit-db.com/exploits/29815 http://packetstormsecurity.com/files/123726/Netgear-ReadyNAS-Complete-System-Takeover.html http://www.readynas.com/?p=7002 http://www.tripwire.com/register/security-advisory-netgear-readynas/ http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/ http://www.osvdb.org/98826 Common Vulnerability Exposure (CVE) ID: CVE-2013-2752 http://www.osvdb.org/98825
Copyright	Copyright (C) 2013 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.