Cisco SN Storage Router Developer Shell Unauthorized Access Vulnerability

Bugtraq ID:	3131
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 01 2001 12:00AM
Updated:	Aug 01 2001 12:00AM
Credit:	This vulnerability was announced in a Cisco Security Advisory on August 1, 2001.
Vulnerable:	Cisco SN 5420 Storage Router 1.1 (3) Cisco SN 5420 Storage Router 1.1 (2) - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0
Not Vulnerable:	Cisco SN 5420 Storage Router 1.1 (4)

Cisco SN Storage Router Developer Shell Unauthorized Access Vulnerability

The Cisco Storage Router is a enterprise-level gigabit-capable routing device designed to handle storage over networks. It is distributed by Cisco Systems.

A problem in the firmware used with SN 5420 routers makes it possible to gain unauthorized access and elevated privileges. A remote user may gain a developer shell from either rlogin via the fibrechannel interface of the router, or through port 8023 on the gigabit side of the router. Commands and configuration changes may be executed from the shell, and are not logged by the SN logging facility,.

Cisco SN Storage Router Developer Shell Unauthorized Access Vulnerability

Solution:
Upgrade available:


Cisco SN 5420 Storage Router 1.1 (2)

• Cisco SN 5420 Storage Router Firmware
  http://www.cisco.com

Cisco SN 5420 Storage Router 1.1 (3)

• Cisco SN 5420 Storage Router Firmware
  http://www.cisco.com

Cisco SN Storage Router Developer Shell Unauthorized Access Vulnerability

References: