Western Digital Arkeia 10.1.x < 10.1.19 / 10.2.x < 10.2.9 Multiple Vulnerabilities (Heartbleed)
High Nessus Plugin ID 74262
Synopsis
The remote web server hosts a virtual appliance that is affected by multiple vulnerabilities.
Description
The self-reported version of the remote Western Digital Arkeia device is prior to 10.1.19 / 10.2.9. It is, therefore, potentially affected by the following vulnerabilities :
- An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions that could allow an attacker to obtain sensitive information such as primary key material, secondary key material, and other protected content.
(CVE-2014-0160)
- A local file inclusion vulnerability exists. A remote, unauthenticated attacker can exploit this issue to read or execute arbitrary files by crafting a request with directory traversal sequences in the 'lang' HTTP cookie.
(CVE-2014-2846)
Solution
Upgrade to version 10.1.19 / 10.2.9 or later.