Samsung SmartEther Switch Firmware Authentication Bypass Vulnerability

Bugtraq ID:	10219
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 26 2004 12:00AM
Updated:	Apr 26 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to Kyle Duren <[email protected]>.
Vulnerable:	Samsung SmartEther SS6215S Switch
Not Vulnerable:

Samsung SmartEther Switch Firmware Authentication Bypass Vulnerability

When accessing a Samsung SmartEther switch, via the telnet service or serial connection, authentication is required and the user is presented with a logon screen. It has been reported that it is possible to bypass this authentication procedure.

An attacker may potentially exploit this condition to, for example, modify static MAC address mapping and perhaps enable man-in-the-middle style attacks. Other attacks are certainly possible.

Samsung SmartEther Switch Firmware Authentication Bypass Vulnerability

There is no exploit required.

Samsung SmartEther Switch Firmware Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Samsung SmartEther Switch Firmware Authentication Bypass Vulnerability

References:

• Samsung SmartEther SS6215S Switch (Kyle Duren )