Craig Young - Slashdot User

Comment Re:Are consumer ReadyNAS products vulnerable too? (Score 1) 53

by Craig Young on Sunday October 27, 2013 @01:35PM (#45252079) Attached to: Users Slow to Update Netgear ReadyNAS Boxes Open To Remote Exploit

Don't expose frontview on any ReadyNAS to an untrusted network.

Comment Re:Are consumer ReadyNAS products vulnerable too? (Score 1) 53

by Craig Young on Wednesday October 23, 2013 @11:30PM (#45220281) Attached to: Users Slow to Update Netgear ReadyNAS Boxes Open To Remote Exploit

FYI - 4.1.12 : http://www.readynas.com/?p=6999 "Updated Frontview to fix security issues."

Comment Re:Are consumer ReadyNAS products vulnerable too? (Score 1) 53

by Craig Young on Wednesday October 23, 2013 @11:28PM (#45220267) Attached to: Users Slow to Update Netgear ReadyNAS Boxes Open To Remote Exploit

NETGEAR updated both the SPARC and x86 based ReadyNAS firmware lines to address the vulnerability. (i.e. 4.1.12 and 4.2.24) The models listed with the firmware updates are as follows: ReadyNAS NV+ v1, ReadyNAS Duo v1, ReadyNAS 1100, ReadyNAS 1500, ReadyNAS 2100, ReadyNAS 3100, ReadyNAS 3200, ReadyNAS 4200, ReadyNAS Ultra 2/Plus, ReadyNAS Ultra 4/Plus, ReadyNAS Ultra 6/Plus, ReadyNAS Pro 2, ReadyNAS Pro 4, ReadyNAS Pro 6, ReadyNAS Pro Business Edition, ReadyNAS Pro Pioneer Edition, ReadyNAS NVX, ReadyNAS NVX Pioneer Edition

Comment Re:But no one told me (Score 1) 53

by Craig Young on Wednesday October 23, 2013 @11:08PM (#45220157) Attached to: Users Slow to Update Netgear ReadyNAS Boxes Open To Remote Exploit

Amen.

Comment Re:White hat (Score 1) 53

by Craig Young on Wednesday October 23, 2013 @11:05PM (#45220143) Attached to: Users Slow to Update Netgear ReadyNAS Boxes Open To Remote Exploit

How hard would it be to write a program to find vulnerable boxes and force a patch via the exploit?

From a strictly technical perspective, this particular vulnerability is in fact not hard at all to exploit and deliver a fix. diff: http://pastebin.com/aWCwdnhL We didn't actually make such a tool but VERT did discuss the possibility.

Slashdot Top Deals