Details of VAR-200801-0148

ID

VAR-200801-0148

CVE

CVE-2008-0524

TITLE

Multiple Yamaha routers vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2008-000005

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in the management interface in multiple Yamaha RT series routers allows remote attackers to change password settings and probably other configuration settings as administrators via unspecified vectors. Multiple Yamaha routers provide a web-based interface for users to configure the settings of the routers. The web interface is vulnerable to cross-site request forgery.If the administrator views a malicious website while logged onto the web interface, the password and other configuration settings can be modified. Exploiting this issue may allow a remote attacker to execute arbitrary actions on an affected device. Yamaha routers in the RT and SRT series are vulnerable. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. The vulnerability is caused due to the device allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. change the administrator password by enticing a logged-in administrator to visit a malicious site. Please see the vendor's advisory for a list of affected models. SOLUTION: Update to the latest firmware versions. Please see the vendor's advisory for details. Do not browse untrusted websites or follow untrusted links while logged on to the device. PROVIDED AND/OR DISCOVERED BY: Reported via JVN. ORIGINAL ADVISORY: Yamaha Corporation: http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN88575577.html JVN#88575577: http://jvn.jp/jp/JVN%2388575577/index.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2008-0524 // JVNDB: JVNDB-2008-000005 // BID: 27491 // VULHUB: VHN-30649 // PACKETSTORM: 63075

AFFECTED PRODUCTS

vendor:	yamaha	model:	rt107e	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rt60w	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtv700	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rta55i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtw65b	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtw65i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rt52pro	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rta52i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rta54i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rt57i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rt80i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rta50i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	srt100	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtx1000	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtx1100	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rt58i	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtx1500	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rt56v	scope:	eq	version:	*	Trust: 1.0
vendor:	yamaha	model:	rtx1500	scope:	-	version:	-	Trust: 0.9
vendor:	yamaha	model:	rtx1100	scope:	-	version:	-	Trust: 0.9
vendor:	yamaha	model:	rtx1000	scope:	-	version:	-	Trust: 0.9
vendor:	yamaha	model:	rtv700	scope:	-	version:	-	Trust: 0.9
vendor:	nec	model:	ip38x series	scope:	eq	version:	1000	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	107e	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	1100	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	1500	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	55i	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	57i	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	58i	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	sr100	Trust: 0.8
vendor:	nec	model:	ip38x series	scope:	eq	version:	v700	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rt56v	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rt57i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rt58i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rt60w	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rt80i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rta50i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rta52i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rta54i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rta55i	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rtw65b	Trust: 0.8
vendor:	yamaha	model:	netvolante series	scope:	eq	version:	rtw65i	Trust: 0.8
vendor:	yamaha	model:	rt series	scope:	eq	version:	rt107e	Trust: 0.8
vendor:	yamaha	model:	rtv series	scope:	eq	version:	rtv01	Trust: 0.8
vendor:	yamaha	model:	rtv series	scope:	eq	version:	rtv700	Trust: 0.8
vendor:	yamaha	model:	rtx series	scope:	eq	version:	rtx1000	Trust: 0.8
vendor:	yamaha	model:	rtx series	scope:	eq	version:	rtx1100	Trust: 0.8
vendor:	yamaha	model:	rtx series	scope:	eq	version:	rtx1500	Trust: 0.8
vendor:	yamaha	model:	srt series	scope:	eq	version:	srt100	Trust: 0.8
vendor:	yamaha	model:	rtw65i	scope:	-	version:	-	Trust: 0.6
vendor:	yamaha	model:	rta54i	scope:	-	version:	-	Trust: 0.6
vendor:	yamaha	model:	srt100	scope:	-	version:	-	Trust: 0.6
vendor:	yamaha	model:	rta52i	scope:	-	version:	-	Trust: 0.6
vendor:	yamaha	model:	rta50i	scope:	-	version:	-	Trust: 0.6
vendor:	yamaha	model:	rtw65b	scope:	-	version:	-	Trust: 0.6
vendor:	yamaha	model:	srt100	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rtw65i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rtw65b	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rta55i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rta54i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rta52i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rta50i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt80i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt60w	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt58i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt57i	scope:	-	version:	-	Trust: 0.3
vendor:	yamaha	model:	rt56v	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt52pro	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt107e	scope:	eq	version:	0	Trust: 0.3

sources: BID: 27491 // JVNDB: JVNDB-2008-000005 // CNNVD: CNNVD-200801-468 // NVD: CVE-2008-0524

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-0524
value:	HIGH
Trust: 1.0
IPA:	JVNDB-2008-000005
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200801-468
value:	HIGH
Trust: 0.6
VULHUB:	VHN-30649
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2008-0524
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
IPA:	JVNDB-2008-000005
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:A/AC:H/AU:N/C:N/I:P/A:P
accessVector:	ADJACENT NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-30649
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-30649 // JVNDB: JVNDB-2008-000005 // CNNVD: CNNVD-200801-468 // NVD: CVE-2008-0524

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-30649 // JVNDB: JVNDB-2008-000005 // NVD: CVE-2008-0524

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200801-468

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-200801-468

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-000005

PATCH

title:	NV08-001	url:	http://www.nec.co.jp/security-info/secinfo/nv08-001.html	Trust: 0.8
title:	JVN88575577	url:	http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN88575577.html	Trust: 0.8

sources: JVNDB: JVNDB-2008-000005

EXTERNAL IDS

db:	JVN	id:	JVN88575577	Trust: 2.9
db:	NVD	id:	CVE-2008-0524	Trust: 2.8
db:	BID	id:	27491	Trust: 2.8
db:	SECUNIA	id:	28690	Trust: 2.7
db:	XF	id:	40015	Trust: 1.4
db:	JVNDB	id:	JVNDB-2008-000005	Trust: 1.1
db:	CNNVD	id:	CNNVD-200801-468	Trust: 0.7
db:	JVN	id:	JVN#88575577	Trust: 0.6
db:	VULHUB	id:	VHN-30649	Trust: 0.1
db:	PACKETSTORM	id:	63075	Trust: 0.1

sources: VULHUB: VHN-30649 // BID: 27491 // JVNDB: JVNDB-2008-000005 // PACKETSTORM: 63075 // CNNVD: CNNVD-200801-468 // NVD: CVE-2008-0524

REFERENCES

url:	http://www.securityfocus.com/bid/27491	Trust: 2.5
url:	http://secunia.com/advisories/28690	Trust: 2.5
url:	http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn88575577.html	Trust: 2.1
url:	http://jvn.jp/jp/jvn%2388575577/index.html	Trust: 2.1
url:	http://xforce.iss.net/xforce/xfdb/40015	Trust: 1.4
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/40015	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0524	Trust: 0.8
url:	http://www.ipa.go.jp/security/english/vuln/200801_yamaha_press_en.html	Trust: 0.8
url:	http://jvn.jp/en/jp/jvn88575577/index.html	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0524	Trust: 0.8
url:	http://www.ipa.go.jp/security/vuln/documents/2008/200801_yamaha.html	Trust: 0.3
url:	http://jvndb.jvn.jp/contents/ja/2008/jvndb-2008-000005.html	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	https://psi.secunia.com/?page=changelog	Trust: 0.1
url:	https://psi.secunia.com/	Trust: 0.1
url:	http://secunia.com/product/17358/	Trust: 0.1
url:	http://secunia.com/advisories/28690/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-30649 // BID: 27491 // JVNDB: JVNDB-2008-000005 // PACKETSTORM: 63075 // CNNVD: CNNVD-200801-468 // NVD: CVE-2008-0524

CREDITS

JPCERT/CC

Trust: 0.6

sources: CNNVD: CNNVD-200801-468

SOURCES

db:	VULHUB	id:	VHN-30649
db:	BID	id:	27491
db:	JVNDB	id:	JVNDB-2008-000005
db:	PACKETSTORM	id:	63075
db:	CNNVD	id:	CNNVD-200801-468
db:	NVD	id:	CVE-2008-0524

LAST UPDATE DATE

2024-11-23T22:32:08.660000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-30649	date:	2017-08-08T00:00:00
db:	BID	id:	27491	date:	2015-05-07T17:33:00
db:	JVNDB	id:	JVNDB-2008-000005	date:	2008-05-21T00:00:00
db:	CNNVD	id:	CNNVD-200801-468	date:	2008-09-05T00:00:00
db:	NVD	id:	CVE-2008-0524	date:	2024-11-21T00:42:18.430

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-30649	date:	2008-01-31T00:00:00
db:	BID	id:	27491	date:	2008-01-29T00:00:00
db:	JVNDB	id:	JVNDB-2008-000005	date:	2008-05-21T00:00:00
db:	PACKETSTORM	id:	63075	date:	2008-01-30T02:17:24
db:	CNNVD	id:	CNNVD-200801-468	date:	2008-01-31T00:00:00
db:	NVD	id:	CVE-2008-0524	date:	2008-01-31T20:00:00