Slashdot Mirror
Hardcoded Password Found in Cisco Software (bleepingcomputer.com)
Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system. From a report: The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers. Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.
Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.
Emphasis mine.
Extenuating circumstances will reduce the amount of guilt. Here escalating local user privileges to root is not extenuating circumstances. Perhaps aggravating circumstances would fit this sentence better.
Yours Sincerely,
Friendly neighborhood pedantic nazi.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
they forget it. Don't have a cow, man! This is not a Stormy Daneils lawsuit!
So in 2018 we're still seeing hardcoded passwords in enterprise products?
In the power of love and the power it has to influence the future generations.
I believe in the strength of life and the light of technology.
I support, for one, the endless waves of Makers and Deep Somethings washing me of my innumerable sins and those of my forefathers.
Je suis silicon.
~Jean Claude
How many did you put in there?
This only allows user level access to the system, not administrative access. So this isn't good, but it's not an open barn door either.
In order to get root access using this method you are going to need some other exploit to elevate your privileges.
Somebody got lazy.. They will get this fixed..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Cisco says that an attacker could exploit this vulnerability ...
I like it - "could" is such a euphemism for a hard-coded password.
Decades ago people dreamed of flying to the stars in XXI century, and instead we have:
* cars with intelligent performance management, which cheat on emission tests and cause thousands premature deaths
* notebooks which intelligently improve user experience, by hijacking encrypted communication injecting ads and rendering all the security useless
* music discs, which (again) improve users experience helping them manage their collections by bypassing their system security to install malware in core of their OS
* brand CPUs, which are designed to be so fast, that they do not even bother to check who is accessing the data, and of course no-one should be worried since it affects "all" CPUs in existence
* and apps with hard-coded password, which could, just potentially could be considered a vulnerability
* not to mention the best business model ever, when one makes money by being lousy with guarding sensitive personal information and later gets payed to inform that the very data might not identify proper person, because it was stolen
No longer true now that we know Cisco is just another NSA department.
CIA/NSA have agents in all major vendor planting bugs in hardware and software.
Nothing from the USA can be trusted
Why is this still happening?
You see...the three letter brigade has been implementing these things in every network vendor's products for years. That's why they are so adamant about companies not using Huawei equipment in their enterprise environment. How can the NSA monitor your activities if you are using equipment that doesn't have their backdoor installed. That has now extended to their consumer offerings. Ask yourself this question...if a phone from a Chinese OEM is that dangerous why aren't they going after Motorola? They moved manufacture of the devices to China after Lenovo purchased them.
ARE you fucking kidding me??
Cisco is turning Chinese or what !?
they admit it now because there's another way in, and it makes them look like the good guys. If you buy American network tech, the Americans will have a way in, and when the vulnerabilities become known, everyone will have a way in.
Buy Ericsson or Nokia, they are safe and have no political allegiance or exist in a country where the government is acting like a terrorist organisation.
It's not like Cisco isn't already letting the CPC insert backdoors in firmware anyway.
CVEs are with us, get over it.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
"...an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers..."
Eh?!?!?
"Hardcoded password"? Just another word for backdoor!
Who allows password login on SSH in 2018? Why? (i.e. why trust any vendors)
PermitRootLogin no
PasswordAuthentication no