SuSE LINUX 9.1 Personal Edition Live CD-ROM SSH Server Default Account Vulnerability

Bugtraq ID:	10297
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	May 06 2004 12:00AM
Updated:	May 06 2004 12:00AM
Credit:	Discovery is credited to Patrick Kranefeld and Fabian Franz.
Vulnerable:	S.u.S.E. LINUX 9.1 Personal Edition CD-ROM
Not Vulnerable:

SuSE LINUX 9.1 Personal Edition Live CD-ROM SSH Server Default Account Vulnerability

It has been reported that SuSE LINUX 9.1 Personal Edition Live CD-ROM can allow an attacker to gain full access to a vulnerable system. The issue presents itself when a user boots the machine with the affected CD-ROM. It has been reported that due to a configuration error, the system configures an SSH server on the host with a default root account.

SuSE LINUX 9.1 Personal Edition Live CD-ROM SSH Server Default Account Vulnerability

This issue does not require exploit code.

SuSE LINUX 9.1 Personal Edition Live CD-ROM SSH Server Default Account Vulnerability

Solution:
SuSE has released an advisory SuSE-SA:2004:011 to address this issue. Please see the referenced advisory for more information.

Updated ISO images can be obtained from the following location:
ftp://ftp.suse.com/pub/suse/i386/live-cd-9.1/LiveCD-9.1-01.iso


S.u.S.E. LINUX 9.1 Personal Edition CD-ROM

• S.u.S.E. LiveCD-9.1-01.iso
  ftp://ftp.suse.com/pub/suse/i386/live-cd-9.1/LiveCD-9.1-01.iso

SuSE LINUX 9.1 Personal Edition Live CD-ROM SSH Server Default Account Vulnerability

References: