RaidSonic NAS-4220-B Encryption Key Disclosure Vulnerability

Bugtraq ID:	28264
Class:	Design Error
CVE:	CVE-2008-1431
Remote:	No
Local:	Yes
Published:	Mar 17 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Collin R. Mulliner discovered this issue.
Vulnerable:	RaidSonic Technology NAS-4220-B 2.6.0-n (2007-10-11)
Not Vulnerable:

RaidSonic NAS-4220-B Encryption Key Disclosure Vulnerability

RaidSonic NAS-4220-B is prone to a vulnerability that can compromise encrypted data. This issue occurs because the key used by the device to encrypt hard-drive data is stored insecurely in the configuration partitions of each drive.

Attackers with physical access to the NAS can exploit this issue to decrypt potentially sensitive information stored on the hard disks.

This issue affects NAS-4220-B running firmware 2.6.0-n(2007-10-11). Other devices and firmware versions may also be affected.

RaidSonic NAS-4220-B Encryption Key Disclosure Vulnerability

To exploit this issue attackers require physical access to an affected device.

RaidSonic NAS-4220-B Encryption Key Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RaidSonic NAS-4220-B Encryption Key Disclosure Vulnerability

References:

• Vendor Homepage (RaidSonic Technology)
  
• raidsonic nas-4220 crypt disk key leak (stored in plain on unencrypted partition ("Collin R. Mulliner" )