Slashdot Mirror
Hardcoded Password Found in Cisco Software (bleepingcomputer.com)
Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system. From a report: The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers. Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.
Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.
Emphasis mine.
Extenuating circumstances will reduce the amount of guilt. Here escalating local user privileges to root is not extenuating circumstances. Perhaps aggravating circumstances would fit this sentence better.
Yours Sincerely,
Friendly neighborhood pedantic nazi.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
So in 2018 we're still seeing hardcoded passwords in enterprise products?
This only allows user level access to the system, not administrative access. So this isn't good, but it's not an open barn door either.
In order to get root access using this method you are going to need some other exploit to elevate your privileges.
Somebody got lazy.. They will get this fixed..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
If it's Dr. Alphonse Mephesto, the eccentric geneticist and stereotypical mad scientist from South Park, there's going to be four backdoors.
#DeleteFacebook
Cisco says that an attacker could exploit this vulnerability ...
I like it - "could" is such a euphemism for a hard-coded password.
Decades ago people dreamed of flying to the stars in XXI century, and instead we have:
* cars with intelligent performance management, which cheat on emission tests and cause thousands premature deaths
* notebooks which intelligently improve user experience, by hijacking encrypted communication injecting ads and rendering all the security useless
* music discs, which (again) improve users experience helping them manage their collections by bypassing their system security to install malware in core of their OS
* brand CPUs, which are designed to be so fast, that they do not even bother to check who is accessing the data, and of course no-one should be worried since it affects "all" CPUs in existence
* and apps with hard-coded password, which could, just potentially could be considered a vulnerability
* not to mention the best business model ever, when one makes money by being lousy with guarding sensitive personal information and later gets payed to inform that the very data might not identify proper person, because it was stolen
CIA/NSA have agents in all major vendor planting bugs in hardware and software.
Nothing from the USA can be trusted
As opposed to China I suppose?
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
they admit it now because there's another way in, and it makes them look like the good guys. If you buy American network tech, the Americans will have a way in, and when the vulnerabilities become known, everyone will have a way in.
Buy Ericsson or Nokia, they are safe and have no political allegiance or exist in a country where the government is acting like a terrorist organisation.
Well, it is pretty much the same, but that is whataboutism.
The better solution is to not use hardware from either of them.
If you absolutely have to you need to consider who is most likely to abuse their backdoor.
Will CIA/NSA use it to hunt terrorism or for industrial espionage. (They have been known to pass on business information to benefit American companies before.)
Will China use it for domestic or industrial espionage. (Both are common.)
Are you a likely target for either of them?
It's not like Cisco isn't already letting the CPC insert backdoors in firmware anyway.
CVEs are with us, get over it.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
The NSA might actually have to get back into crypto again rather than just expecting big brand hardware to be shipped with a password.
Designed in the USA. NSA inside.
Domestic spying is now "Benign Information Gathering"
I agree with part of what you wrote: proprietary software organizations that have known NSA, CIA, etc. ties are certainly not to be trusted. But the reason they're not to be trusted has nothing to do with the country they call home. American proprietors, for instance, were not to be trusted regardless of any ties to mass surveillance. The linkage to mass surveillance is piling on; taking something that's already rejectable (proprietary software) and adding more reason to be suspicious. We have to treat all proprietary software as untrusted (regardless of who or where it comes from) precisely because we don't get the freedoms of free software (to run, inspect, share, and modify).
Regarding "Nothing from the USA can be trusted": There are lots of American free software developers, and they're all helping us right along side every other free software developer. And as with any other free software, you don't need to trust the developer to trust free software: inspect the code (or get someone you trust to do this for you), make necessary changes, and run the code you trust. I also encourage you to help your community by publishing the improved code.
Dismissing developers due to the country they come from or work in a way of saying you didn't think through how software freedom works.
Digital Citizen