Engenio Storage Controllers TCP packet denial of service
| engenio-controller-tcp-dos (17290) |  Medium Risk |
Description:
Multiple disk systems and switches that use Engenio Storage Controllers are vulnerable to a denial of service attack. By sending specially-crafted TCP packets to a vulnerable device, a remote attacker could cause the device to crash.
Consequences:
Denial of Service
Remedy:
For Brocade switches:
Upgrade to the latest firmware version (3.2 or later), available from the Brocade Web site. See References.
References:
- Brocade Web site: Brocade Switches.
- BugTraq Mailing List, Sat Sep 04 2004 - 07:43:12 CDT: Engenio/LSI Logic controllers denial of service/data corruption.
- BugTraq Mailing List, Sun Sep 05 2004 - 02:50:02 CDT : Denial of service in Brocade switches (was: Engenio/LSI Logic controllers denial of service/data corruption).
- Engenio Information Technologies, Inc. Web site: Controllers.
- BID-11108: Engenio Storage Controller Remote Denial Of Service Vulnerability
- CVE-2004-1663: Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm Switches, allow remote attackers to cause a denial of service (freeze and possible data corruption) via crafted TCP packets.
- SA12464: Engenio Storage Controllers Denial of Service Vulnerability
Platforms Affected:
- Brocade Fabric OS 2.1.2
- Brocade Fabric OS 2.2
- Brocade Fabric OS 3.1
- Brocade SilkWorm 3250 Fabric Switch
- Brocade SilkWorm 3850 Fabric Switch
- Brocade SilkWorm 3900 Fabric Switch
- Engenio Information Technologies Engenio Storage Controller
- IBM DS4100
- StorageTek D280
Reported:
Sep 04, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net