Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Device (Embedded Server/Appliance)  >   SmartStor Vendors:   Promise Technology
Promise SmartStor NS4300N Lets Remote Authenticated Users Gain Administrative Access
SecurityTracker Alert ID:  1018754
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 28 2007
Impact:   Modification of authentication information, Root access via network
Exploit Included:  Yes  
Version(s): NS4300N; firmware version
Description:   A vulnerability was reported in SmartStor NS4300N. A remote authenticated user can gain administrative access.

The 'usercp.php' script does not properly validate user-supplied parameters. A remote authenticated user can modify the password of the 'root' or 'admin' account. Then, the remote user can login with the new password to gain administrative access.

Tor Houghton reported this vulnerability.

Impact:   A remote authenticated user can modify the administrative account password to gain administrative access.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Access control error

Message History:   None.

 Source Message Contents

Subject:  Promise NAS NS4300N GUI bug


There is a bug in the Promise NAS NS4300N web GUI (firmware version
which allows an authenticated (admin) user to change the password of the
'root' account.

The user management portion of the web interface allows the admin user to
change user's passwords. The PHP script that handles this does not check to
see if the admin is changing a user account or system accounts such as

By changing the value of the 'user' parameter to 'root' (from whatever user
id whose password is being changed, e.g. 'admin' if you have not defined any
users) in the POST request to /usercp.php, we can provide a known password
for the root account and thereby login to the NAS (which is normally not
possible because Promise has not divulged root's password).

The vendor has not been notified, but this is hardly a critical issue..?


moonshade:~$ telnet 2380
Connected to
Escape character is '^]'.
NS4300N R1.1 A10 (Version 01.01.0000.05) - Promise Technology, INC.
nas login: root

BusyBox v1.00-rc2 (2006.11.07-01:55+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

root is allowed to login.
[root@nas]# dmesg
Linux version 2.6.11SR1_1_2 (root@localhost.localdomain) (gcc version 3.4.1) #2 Tue Apr 3 15:43:13 CST 2007
On node 0 totalpages: 32768
  DMA zone: 32768 pages, LIFO batch:8
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=/dev/ram rw console=ttyS0,115200
IPIC (128 IRQ sources, 8 External IRQs) at fe000700
PID hash table entries: 1024 (order: 10, 16384 bytes)
Console: colour dummy device 80x25
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 123936k available (2276k kernel code, 660k data, 312k init, 0k highmem)
Calibrating delay loop... 265.21 BogoMIPS (lpj=132608)



Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, LLC