[33841] in bugtraq
Re: Fw: APC 9606 SmartSlot Web/SNMP management card "backdoor"
daemon@ATHENA.MIT.EDU (Tom)
Thu Feb 19 15:06:17 2004
Message-Id: <6.0.1.1.2.20040219075810.0295bec0@mail.ispstuff.com>
Date: Thu, 19 Feb 2004 08:10:45 -0600
To: bugtraq@securityfocus.com
From: Tom <tom@ispstuff.com>
In-Reply-To: <200402172256.58290.james@stealthnet.co.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Vulnerability tested and Fixed in :
MasterSwitch AP9211 with AP9606 AOS v3.0.9a and MasterSwitch APP v2.2.5a
Patch from APC web site. Here's the web link.
http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=3131&p_created=1077139129
At 04:56 PM 2/17/2004, you wrote:
>On Tuesday 17 Feb 2004 6:23 pm, thiago.vazquez@light.com.br wrote:
> > We have many products from APC and we've tested that vulnerability in some
> > of them and ..... following are the results.
>
>[ snip ]
>
>According to a Matias Kvaternik at APC (US) today, the bug was discovered
>after the AP9606 was discontinued (we bought some less than one year ago),
>and the engineering team has "no fix in the pipeline". He advises us to
>switch off telnet access.
>
>I would imagine most APC products are installed to last for a good three to
>six years - upgrading power hardware is probably about as practical as
>upgrading a load of networking equipment. I'm surprised, indeed disappointed,
>that APC doesn't appear to provide critical security fixes for these
>discontinued products; although I do only speak from very limited experience
>of APC.
>
>
>James Green
