CRITICAL Vulnerability in the 3.x firmware

[fajo]

I just opened a support ticket (EEW-834557) with Thecus to inform them about another critical vulnerability. The new 3.x firmware allows potential attackers to become any user (even "admin") bypassing the authentication. Exploits are available.

All users of devices running a 3.x firmware should make sure the WebUI is not accessible from insecure networks (such as the Internet) until this vulnerability is fixed.

Update 2009/11/26 - Received a reply from Thecus, they "hope it can be fixed soon"

/Falk

P.S.: I will not publish any details on the exploits ... but I will probably not be the only one who knows about this already

[gyrfalcon]

Nov 21, 2009 5:48:22 GMT 7 fajo said:

...P.S.: I will not publish any details on the exploits ... but I will probably not be the only one who knows about this already

It's idiotic to post warnings instead of full disclosure concerning the vulnerability. If you can't do full disclosure you should at the very least disclose what the vulnerability affects so it can be mitigated by end-users.

[fajo]

Jan 26, 2010 4:12:57 GMT 7 gyrfalcon said:

It's idiotic to post warnings instead of full disclosure concerning the vulnerability.

... is it ? What information did you expect me to give you in addition to what I did already ?

Jan 26, 2010 4:12:57 GMT 7 gyrfalcon said:

... you should at the very least disclose what the vulnerability affects

Sorry, but I did not expect that there might be someone not knowing about the "power" of the admin user ...

Jan 26, 2010 4:12:57 GMT 7 gyrfalcon said:

so it can be mitigated by end-users.

The only mitigating action would be to isolate the web interface ... and that is exactly what the warning says.

/Falk

[ann]

Velveeta Macaroni and Cheese Bake wow power leveling
1 (16 oz.) box of Macaroni ¨C uncooked, 1/2 cup of butter or margarine, wow power leveling 1/2 cup of all purpose flour, 4 cups of milk, 1 (14 oz.) package of Velveeta cheese, cut into chunks, aion kina salt and pepper to taste, 8 slices of Velveeta cheese.Preheat the oven to 350 degrees. aion kinah Prepare a 13x9-inch baking dish with cooking oil or spray. aion power level In a large saucepan, melt the butter over medium heat. cheap aion power leveling Whisk in the flour and milk. Cook over medium heat, ÖØÇì¶þÊÖµçÄÔ stirring constantly, until mixture begins to bubble and thickens. buy wow gold Put in the chunks of Velveeta and allow them to melt. Add in the salt and the pepper.