CVE-2009-3200

The CVE-2009-3200 entry describes a vulnerability in QNAP TS-239 Pro and TS-639 Pro devices running firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815. An undocumented recovery key is created and stored in the ENCK variable in flash memory, allowing local users to bypass the passphrase and decrypt t...

Advisory: Crypto backdoor in Qnap storage devices (CVE-2009-3200)

Title: Crypto backdoor in Qnap storage devices Date: 18 September 2009 URL: http://www.baseline-security.de/downloads/BSC-QnapCryptoBackdoor-CVE-2009-3200.txt Vendor: QNAP Systems Products verified: TS-239 Pro, TS-639 Pro Products unverified: SS-439 Pro, TS-439 Pro, TS-439U-SP/RP, TS-509 Pro,...

CVE-2009-3279: Undefined Security Weakness

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create a LUKS partition by using the AES-256 cipher in plain CBC mode, which allows local users to obtain sensitive information via a watermark attack...

CVE-2009-3278: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack...

CVE-2009-3200: Undefined Security Weakness

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable,...

CVE-2008-6247: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in topsite.php in Scripts For Sites SFS EZ Top Sites allows remote attackers to execute arbitrary SQL commands via the ts parameter...

Nokia S60系列手机畸形短信/彩信远程拒绝服务漏洞

BUGTRAQ ID: 33074 Nokia S60系列是运行symbian平台的智能手机。 3GPP TS 23.040标准中规定了通过短信发送邮件的方法。邮件短信的最基本形式以MT-SMS或MO-SMS开始，之后为空格，最后为消息正文。短信消息的TP协议标识符必须设置为Internet Electronic Mail（值为50/0x32）。 但上述标准没有规定手机接收到短信后如何显示。在S60 2.6之前版本，Series60设备按原样显示消息；从S60...

Nokia S60 SMSMMS (Curse of Silence) - Denial of Service

Nokia S60 SMSMMS Curse of Silence - Denial of Service Vulnerability Advisory ====================== Remote SMS/MMS Denial of Service - "Curse Of Silence" for Nokia S60 phones URL === https://berlin.ccc.de/tobias/cos/s60-curse-of-silence-advisory.txt Video =====...

Nokia S60 SMS/MMS (Curse of Silence) - Denial of Service

Vulnerability Advisory ====================== Remote SMS/MMS Denial of Service - "Curse Of Silence" for Nokia S60 phones URL === https://berlin.ccc.de/tobias/cos/s60-curse-of-silence-advisory.txt Video ===== https://berlin.ccc.de/tobias/cos/s60-curse-of-silence-demo.avi Affected Products...

Nokia S60 SMS/MMS (Curse of Silence) Denial of Service Vulnerability

Exploit for hardware platform in category dos / poc ==================================================================== Nokia S60 SMS/MMS Curse of Silence Denial of Service Vulnerability ==================================================================== Vulnerability Advisory...

CVE-2002-0977: Undefined Security Weakness

Buffer overflow in Microsoft File Transfer Manager FTM ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a long TS value...