Promise NAS NS4300N superuser access protection bypass

It's possible to bypass resttrictions for direct remote root access...

promise-root.txt

List, There is a bug in the Promise NAS NS4300N web GUI firmware version 1.1.0.5 which allows an authenticated admin user to change the password of the 'root' account. The user management portion of the web interface allows the admin user to change user's passwords. The PHP script that handles th...

GLSA-200704-20 : NAS: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200704-20 NAS: Multiple vulnerabilities Luigi Auriemma has discovered multiple vulnerabilities in NAS, some of which include a buffer overflow in the function acceptattlocal, an integer overflow in the function ProcAuWriteElement,...

NAS: Multiple vulnerabilities

Background NAS is a network transparent, client/server audio transport system. Description Luigi Auriemma has discovered multiple vulnerabilities in NAS, some of which include a buffer overflow in the function acceptattlocal, an integer overflow in the function ProcAuWriteElement, and a null...

Debian DSA-1273-1 : nas - several vulnerabilities

Several vulnerabilities have been discovered in nas, the Network Audio System. - CVE-2007-1543 A stack-based buffer overflow in the acceptattlocal function in server/os/connection.c in nas allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection. -...

USN-446-1: NAS vulnerabilities

Luigi Auriemma discovered multiple flaws in the Network Audio System server. Remote attackers could send specially crafted network requests that could lead to a denial of service or execution of arbitrary code. Note that default Ubuntu installs do not include the NAS server...

[SECURITY] [DSA 1273-1] New nas packages fix multiple remote vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1273-1 [email protected] http://www.debian.org/security/ Noah Meyerhans March 27, 2007 - ------------------------------------------------------------------------ Package : nas Vulnerability :...

[SECURITY] [DSA 1273-1] New nas packages fix multiple remote vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1273-1 [email protected] http://www.debian.org/security/ Noah Meyerhans March 27, 2007 - ------------------------------------------------------------------------ Package : nas Vulnerability :...

[NEWS] Multiple Vulnerabilities In NAS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Code injection

The AddResource function in server/dia/resource.c in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service server crash via a nonexistent client ID...

Command injection

Array index error in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service crash via 1 large numaction values in the ProcAuSetElements function in server/dia/audispatch.c or 2 a large inputNum parameter to the compileInputs function in server/dia/auutil...

CVE-2007-1546

Array index error in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service crash via 1 large numaction values in the ProcAuSetElements function in server/dia/audispatch.c or 2 a large inputNum parameter to the compileInputs function in server/dia/auutil...

CVE-2007-1546

CVE-2007-1546 affects the Network Audio System (NAS) prior to 1.8a SVN 237. The vulnerability is an array index error in NAS code paths: ProcAuSetElements (server/dia/audispatch.c) and compileInputs (server/dia/auutil.c). A remote attacker can trigger a denial of service (crash) by sending large ...

CVE-2007-1545

CVE-2007-1545 is a vulnerability in Network Audio System (NAS) prior to NAS 1.8a SVN 237 where the AddResource function can crash the server via a nonexistent client ID, enabling a remote denial of service. The connected Debian advisory (DSA-1273-1) enumerates five NAS flaws (CVE-2007-1543 to CVE...

CVE-2007-1547

Vulnerability (CVE-2007-1547) affects the Network Audio System (NAS). The issue is in the ReadRequestFromClient function (server/os/io.c) where handling multiple simultaneous connections can trigger a NULL pointer dereference, allowing a remote attacker to cause a crash (DoS). Affected software i...

CVE-2007-1543

Stack-based buffer overflow in the acceptattlocal function in server/os/connection.c in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection...

CVE-2007-1543

The CVE-2007-1543 issue affects Network Audio System (NAS) prior to 1.8a SVN 237. A stack-based buffer overflow in accept_att_local (server/os/connection.c) can be triggered by a long path slave name over a USL socket, enabling remote code execution. Other CVEs (CVE-2007-1544 to CVE-2007-1547) ac...

CVE-2007-1544

CVE-2007-1544 affects the Network Audio System (nas) server. A stack/integer overflow in ProcAuWriteElement (server/dia/audispatch.c) in NAS versions before 1.8a SVN 237 enables a remote attacker to crash the service and potentially execute arbitrary code via a large max_samples value. This is on...

CVE-2006-3878

CVE-2006-3878 concerns Opsware Network Automation System (NAS) 6.0. The issue arises because NAS installs /etc/init.d/mysql with insecure permissions, enabling local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql. The root cause is imp...

Opsware NAS 6.0 reveals MySQL 'root' password

The Opsware Network Automation System NAS version 6.0 installation places an 'init' style startup script in /etc/init.d/mysqll and places the 'root' password that you choose for the MySQL MAX database during installation. The permissions on this small shell script are world readable, allowing any...