Opsware NAS Root Password Information Disclosure Vulnerability

Bugtraq ID:	19126
Class:	Configuration Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 24 2006 12:00AM
Updated:	Aug 24 2006 08:49PM
Credit:	Micheal Freeman has been credited with the discovery of this vulnerability
Vulnerable:	Opsware NAS 6.0
Not Vulnerable:	Opsware NAS 6.1.2

Opsware NAS Root Password Information Disclosure Vulnerability

Opsware NAS is prone to a local information-disclosure vulnerability. This issue occurs because the application fails to protect sensitive information to unprivileged users.

An attacker can exploit this issue by gaining access to the root MySQL account and reveal authentication credentials for network devices. This issue could also lead to other attacks.

Opsware NAS 6.0 is vulnerable to this issue; other versions may also be affected.

Opsware NAS Root Password Information Disclosure Vulnerability

An exploit is not required.

Opsware NAS Root Password Information Disclosure Vulnerability

Solution:
The vendor released version 6.1.2 to address this issue. Please see references for further information.

The vendor has released an advisory that states that the following packages are not affected:

- All Microsoft Windows versions.
- NAS versions running on Linux/Solaris using Oracle/SQL Server.
- NAS versions running Linux/Solaris and uses MySQL whereby the database is running on a different server.

Please refer to the vendor's advisory for more information.

Opsware NAS Root Password Information Disclosure Vulnerability

References:

• TIBCO Homepage (TIBCO)
  
• TIBCO Rendezvous Home Page (TIBCO)
  
• Opsware NAS 6.0 reveals MySQL 'root' password ( danil947)
  
• Opsware NAS 6.0 reveals MySQL 'root' password (Micheal Freeman)