Standard & Poor's ComStock Machine Vulnerabilities
BID:1080
Info
Standard & Poor's ComStock Machine Vulnerabilities
| Bugtraq ID: | 1080 |
| Class: | Unknown |
| CVE: |
CVE-2000-0109 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 24 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by [email protected] on March 24, 2000. A followup was posted on May 17, 2000 by Stephen Friedl <[email protected]> |
| Vulnerable: |
Standard & Poors ComStock 4.2.4 |
| Not Vulnerable: | |
Discussion
Standard & Poor's ComStock Machine Vulnerabilities
Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1 distribution. In addition, it contains numerous accounts with weak, or nonexistent passwords.
The ComStock MultiCSP machine is intended to provide a realtime stock quote stream. It runs a proprietary service called 'mcsp' to provide this service. These machines acquire their data via a leased line, or other dedicated data connection. They used reserved address space. However, no attempt is made to prevent these ComStock machines from being used to compromise other machines on the private network. In addition, the routers utilized on the private network these machines communicate over are internet-accessible.
Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1 distribution. In addition, it contains numerous accounts with weak, or nonexistent passwords.
The ComStock MultiCSP machine is intended to provide a realtime stock quote stream. It runs a proprietary service called 'mcsp' to provide this service. These machines acquire their data via a leased line, or other dedicated data connection. They used reserved address space. However, no attempt is made to prevent these ComStock machines from being used to compromise other machines on the private network. In addition, the routers utilized on the private network these machines communicate over are internet-accessible.
Exploit / POC
Standard & Poor's ComStock Machine Vulnerabilities
There are numerous accounts with easily guessable passwords. The following are well known passwords:
User: root Password: c0mst0ck
User: helpmcsp: Password: (none)
User: helpicl Password: (none)
The helpmcsp and helpicl accounts will display a set of help to the user accessing these accounts, using the 'more' command. Shell level access can be gained as follows:
Hit 'v' to bring up the file in vi
:set shell=/bin/bash <RETURN>
:shell <RETURN>
In addition, many RedHat 5.1 exploits should allow for the compromise of these machines.
There are numerous accounts with easily guessable passwords. The following are well known passwords:
User: root Password: c0mst0ck
User: helpmcsp: Password: (none)
User: helpicl Password: (none)
The helpmcsp and helpicl accounts will display a set of help to the user accessing these accounts, using the 'more' command. Shell level access can be gained as follows:
Hit 'v' to bring up the file in vi
:set shell=/bin/bash <RETURN>
:shell <RETURN>
In addition, many RedHat 5.1 exploits should allow for the compromise of these machines.
Solution / Fix
Standard & Poor's ComStock Machine Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Some work arounds:
1) Remove /etc/issue, as it lists many of the accounts on these machines.
2) Change the passwords on all the accounts present in /etc/passwd to stronger passwords, or lock them entirely. This may cause issues -- as such, care should be taken, and the vendor should be contacted to determine the impact of doing this.
3) Eliminate unneeded services. Samba, a webserver, portmapper, and SNMP are just a few of the services running that are probably unneeded.
4) Use TCP wrappers, and use ipchains to limit access to the machine to the specific IP's which should connect to it. Two hosts which likely need to have access are listed in the /etc/hosts file:
172.23.94.10 BIG1
172.23.95.10 BIG2
These suggestions are by no means comprehensive, and even having performed the above, it is likely the machine may be susceptible to other problems, as it is running a fairly old distribution of RedHat.
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Some work arounds:
1) Remove /etc/issue, as it lists many of the accounts on these machines.
2) Change the passwords on all the accounts present in /etc/passwd to stronger passwords, or lock them entirely. This may cause issues -- as such, care should be taken, and the vendor should be contacted to determine the impact of doing this.
3) Eliminate unneeded services. Samba, a webserver, portmapper, and SNMP are just a few of the services running that are probably unneeded.
4) Use TCP wrappers, and use ipchains to limit access to the machine to the specific IP's which should connect to it. Two hosts which likely need to have access are listed in the /etc/hosts file:
172.23.94.10 BIG1
172.23.95.10 BIG2
These suggestions are by no means comprehensive, and even having performed the above, it is likely the machine may be susceptible to other problems, as it is running a fairly old distribution of RedHat.
References
Standard & Poor's ComStock Machine Vulnerabilities
References:
References: