Qnap Storage Devices Unauthorized Access Vulnerability and Security Weakness

Bugtraq ID:	36467
Class:	Unknown
CVE:	CVE-2009-3200
Remote:	No
Local:	Yes
Published:	Sep 19 2009 12:00AM
Updated:	Apr 13 2015 09:06PM
Credit:	Baseline Security Consulting
Vulnerable:	Qnap TS-639 Pro 3.1.1.0815 Qnap TS-639 Pro 3.1.0.627 Qnap TS-639 Pro 2.1.7.0613 Qnap TS-239 Pro 3.1.1.0815 Qnap TS-239 Pro 3.1.0.627 Qnap TS-239 Pro 2.1.7.0613
Not Vulnerable:

Qnap Storage Devices Unauthorized Access Vulnerability and Security Weakness

Qnap Storage Devices are prone to an unauthorized-access vulnerability and a security weakness that may allow the device to generate weak random numbers.

An attacker can exploit the unauthorized-access issue to decrypt the hard disk by using the key stored in flash memory. The attacker can exploit the security weakness in conjunction with other latent vulnerabilities to gain unauthorized access to the affected device.

TS-239 Pro and TS-639 Pro firmware versions 3.1.1 0815, 3.1.0 0627, and 2.1.7 0613 are vulnerable; other versions may also be affected.

Qnap Storage Devices Unauthorized Access Vulnerability and Security Weakness

An attacker can use brute-force techniques to exploit this issue.

Qnap Storage Devices Unauthorized Access Vulnerability and Security Weakness

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Qnap Storage Devices Unauthorized Access Vulnerability and Security Weakness

References:

• Crypto backdoor in Qnap Storage Devices (BaseLine Security Consulting)
  
• Vendor Homepage (QNAP System )