CVE-2002-1863: Medium severity Iomega Network Attached Storage vulnerability
Iomega Network Attached Storage (NAS) A300U, and possibly other models, does not allow the FTP service to be disabled, which allows local users to access home directories via FTP even when access to all shared directories have been disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block FTP traffic (TCP ports 20 and 21) to the Iomega NAS devices (e.g., A300U) at the network perimeter and on internal network segments where user workstations reside. Implement firewall or switch ACL rules that deny TCP 20/21 to the NAS IP addresses to prevent FTP access to home directories.
- Compensating control
Restrict access to the NAS management and FTP service to a trusted management network or specific administrative IP addresses only. Implement firewall rules or VLAN segmentation so that only authorized management hosts can reach the NAS administration/FTP ports.
Event History
Frequently Asked Questions
What is the severity of CVE-2002-1863?
CVE-2002-1863 is classified as a moderate severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2002-1863?
To mitigate CVE-2002-1863, ensure that access to FTP services is restricted and implement network segmentation.
Who is affected by CVE-2002-1863?
CVE-2002-1863 affects Iomega Network Attached Storage A300U and possibly other models that do not allow FTP service to be disabled.
What are the consequences of CVE-2002-1863?
The consequences of CVE-2002-1863 include unauthorized local access to home directories even when shared directory access is disabled.
Is CVE-2002-1863 currently being exploited in the wild?
There are no current reports indicating that CVE-2002-1863 is actively being exploited in the wild, but it remains a potential security risk.