[UNIX] Promise NAS NS4300N GUI Privilege Escalation Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Promise NAS NS4300N GUI Privilege Escalation Vulnerability
------------------------------------------------------------------------

SUMMARY

A bug in the Promise NAS NS4300N web GUI allows an authenticated (admin)
user to change the password of the 'root' account.

DETAILS

Vulnerable Systems:
* Promise NAS NS4300N web GUI firmware version 1.1.0.5

The user management portion of the web interface allows the admin user to
change user's passwords. The PHP script that handles this does not check
to see if the admin is changing a user account or system accounts such as
'root'.

By changing the value of the 'user' parameter to 'root' (from whatever
user id whose password is being changed, e.g. 'admin' if you have not
defined any users) in the POST request to /usercp.php, we can provide a
known password for the root account and thereby login to the NAS (which is
normally not possible because Promise has not divulged root's password).

Example:
moonshade:~$ telnet 192.168.5.16 2380
Trying 192.168.5.16...
Connected to 192.168.5.16.
Escape character is '^]'.
NS4300N R1.1 A10 (Version 01.01.0000.05) - Promise Technology, INC.
nas login: root
Password:

BusyBox v1.00-rc2 (2006.11.07-01:55+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

root is allowed to login.
[root@nas]# dmesg
Linux version 2.6.11SR1_1_2 (root@localhost.localdomain) (gcc version
3.4.1) #2 Tue Apr 3 15:43:13 CST 2007
On node 0 totalpages: 32768
DMA zone: 32768 pages, LIFO batch:8
Normal zone: 0 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=/dev/ram rw console=ttyS0,115200
IPIC (128 IRQ sources, 8 External IRQs) at fe000700
PID hash table entries: 1024 (order: 10, 16384 bytes)
Console: colour dummy device 80x25
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 123936k available (2276k kernel code, 660k data, 312k init, 0k
highmem)
Calibrating delay loop... 265.21 BogoMIPS (lpj=132608)

ADDITIONAL INFORMATION

The information has been provided by <mailto:torh@bogus.net> Tor
Houghton.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.