Seagate BlackArmor NAS 220 Multiple Security Vulnerabilities

Bugtraq ID:	64655
Class:	Unknown
CVE:	CVE-2013-6923 CVE-2013-6922 CVE-2013-6924
Remote:	Yes
Local:	Yes
Published:	Jan 06 2014 12:00AM
Updated:	Mar 19 2015 09:05AM
Credit:	Jeroen - IT Nerdbox
Vulnerable:
Not Vulnerable:

Seagate BlackArmor NAS 220 Multiple Security Vulnerabilities

BlackArmor NAS 220 storage server is prone to the following remote security vulnerabilities:

1. Multiple cross-site request forgery vulnerabilities
2. Multiple HTML-injection vulnerabilities
3. An arbitrary code-execution vulnerability

Attackers can exploit these issues to perform certain unauthorized actions, execute HTML and script code and steal cookie-based authentication credentials and execute arbitrary code. Other attacks are possible.

BlackArmor NAS 220 running firmware sg2000-2000.1331 is vulnerable; other versions may also be affected.

Seagate BlackArmor NAS 220 Multiple Security Vulnerabilities

Attackers can exploit some of these issues through browser or using readily available tools.

The following exploit code is available:

• /data/vulnerabilities/exploits/64655.php.txt

Seagate BlackArmor NAS 220 Multiple Security Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Seagate BlackArmor NAS 220 Multiple Security Vulnerabilities

References: