----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
RaidSonic ICY BOX NAS-4220-B Insecure Storage of Encryption Key

SECUNIA ADVISORY ID:
SA29401

VERIFY ADVISORY:
http://secunia.com/advisories/29401/

CRITICAL:
Not critical

IMPACT:
Exposure of sensitive information

WHERE:
Local system

OPERATING SYSTEM:
RaidSonic ICY BOX NAS-4220-B
http://secunia.com/product/17944/

DESCRIPTION:
Collin Mulliner has reported a security issue in RaidSonic
NAS-4220-B, which can be exploited by malicious people with physical
access to the device to disclose potentially sensitive information.

The security issue is caused due to the device storing the
base64-encoded encryption key of an encrypted partition in the file
".crypt" on the unencrypted "system" partition on the same disk.

The security issue is reported in NAS-4220-B with firmware 2.6.0-n
(2007-10-11). Other versions may also be affected.

SOLUTION:
Do not rely on the disk encryption feature.

PROVIDED AND/OR DISCOVERED BY:
Collin Mulliner

ORIGINAL ADVISORY:
http://www.mulliner.org/security/advisories/raidsonic_nas4220_crypt_disk_key_leak_09Mar2008.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------