[Japanese]

JVNDB-2009-000053

Cross-site request forgery vulnerability in FreeNAS

Overview

FreeNAS contains a cross-site request forgery vulnerability.

FreeNAS is a NAS (Network Attached Storage) server software. FreeNAS contains a cross-site request forgery vulnerability.

Hiroyuki Shinshiba of LAC:Little eArth Corporation Co., LTD. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 7.1 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Complete
  • Availability Impact: Complete
Affected Products


FreeNAS Project
  • FreeNAS 0.69.2 and earlier

Impact

If a user views a malicious web page while logged into the web-based interface, an attacker could modify configurations or delete data on the hard disk drive.
Solution

[Update the Software]
Update to the latest version according to the information provided by the developer. The version that addresses this vulnerability was released as FreeNAS 0.7RC1.
Vendor Information

FreeNAS Project
CWE (What is CWE?)

  1. Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2009-2738
References

  1. JVN : JVN#15267895
  2. National Vulnerability Database (NVD) : CVE-2009-2738
  3. IPA SECURITY ALERTS : Security Alert for Vulnerability in FreeNAS
Revision History

  • [2009/08/05]
      Web page published

Date Public2009/08/05
Date First Published2009/08/05
Date Last Updated2009/08/05