search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Multiple ANTlabs InnGate models allow unauthenticated read/write to filesystem

Vulnerability Note VU#930956

Original Release Date: 2015-03-26 | Last Revised: 2015-03-26

Overview

ANTlabs InnGate is a gateway device designed for operating corporate guest/visitor networks. Multiple models and firmware versions of the InnGate has been shown to allow read/write access to remote unauthenticated users via a misconfigured rsync instance.

Description

CWE-276: Incorrect Default Permissions

The instance of rsync included with the InnGate firmware is incorrectly configured to allow the entire filesystem to be read/write without authentication. A remote unauthenticated attacker may read or modify any file on the device's filesystem. More details can be found in a blog post from Cylance, Inc.

Devices containing affected firmware include:

    • IG 3100 model 3100, model 3101
    • InnGate 3.00 E-Series, 3.01 E-Series, 3.02 E-Series, 3.10 E-Series
    • InnGate 3.01 G-Series, 3.10 G-Series

Impact

A remote unauthenticated attacker may read or modify any file on the device's filesystem.

Solution

Update the firmware
According to the ANTlabs Security Advisory, a software update addressing this vulnerability has been released. Users are encouraged to upgrade affected devices' software as soon as possible. Affected users may contact ANTlabs Support (tech-support@antlabs.com) for more information or to obtain the software update.

If a firmware update is currently not possible, the following workaround may help mitigate this issue.

Block rsync

Administrators may block unrestricted access to the rsync TCP port 873 on the affected network.

Vendor Information

930956
Expand all

ANTlabs

Notified:  March 03, 2015 Updated:  March 26, 2015

Statement Date:   March 10, 2015

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Devices containing affected firmware include:

      • IG 3100 model 3100, model 3101
      • InnGate 3.00 E-Series, 3.01 E-Series, 3.02 E-Series, 3.10 E-Series
      • InnGate 3.01 G-Series, 3.10 G-Series

According to the

Vendor References

http://www.antlabs.com/index.php?option=com_content&view=article&id=195:rsync-remote-file-system-access-vulnerability-cve-2015-0932&catid=54:advisories&Itemid=133

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 8.3 E:F/RL:OF/RC:C
Environmental 6.2 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Credit to Justin W. Clarke of Cylance Inc. for reporting this vulnerability. Also a thank you to ANTlabs for quickly addressing this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: CVE-2015-0932
Date Public: 2015-03-26
Date First Published: 2015-03-26
Date Last Updated: 2015-03-26 14:59 UTC
Document Revision: 48

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.