[Japanese]

JVNDB-2008-000079

I-O DATA DEVICE HDL-F series cross-site request forgery vulnerability

Overview

The HDL-F series products from I-O DATA DEVICE, INC. are LAN connectable hard disk drives. The web interface for administration in the products contains a cross-site request forgery vulnerability.

The HDL-F series products provided by I-O DATA DEVICE, INC. are LAN connectable hard disk drives. Configuration of these devices are done through a web-based interface. This web interface is vulnerable to cross-site request forgery.

Firmware updates addressing this vulnerability have been provided by the vendor since August 28, 2008.

Takayuki Ogiso reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

Base Metrics: 7.0 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Complete
  • Availability Impact: Complete

Affected Products


I-O DATA DEVICE, INC.
  • HDL-F Series

Impact

If a user views a malicious web page while logged into the web-based interface, an attacker could modify configurations or delete data on the hard disk drive.
Solution

[Update the Software]
Apply the firmware updates provided by the vendor.
Vendor Information

I-O DATA DEVICE, INC.
  • I-O DATA : hdl-f (Japanese)
  • I-O DATA : HDL-F (Japanese)
CWE (What is CWE?)

  1. Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2008-5382
References

  1. JVN : JVN#70599814
  2. National Vulnerability Database (NVD) : CVE-2008-5382
  3. IPA SECURITY ALERTS : Security Alert for I-O DATA DEVICE HDL-F Series Vulnerability
  4. Secunia Advisory : SA32836
  5. OPEN SOURCE VULNERABILITY DATABASE (OSVDB) : 50183
  6. JVN iPedia (Japanese) : JVNDB-2008-000079
Revision History

[2008/12/02]
  Web page published