Netpliance i-opener Password Vulnerability
BID:1116
Info
Netpliance i-opener Password Vulnerability
| Bugtraq ID: | 1116 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2000 12:00AM |
| Updated: | Apr 15 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on April 15, 2000 by Sean <[email protected]> |
| Vulnerable: |
Netpliance i-opener 1.0 |
| Not Vulnerable: | |
Discussion
Netpliance i-opener Password Vulnerability
A vulnerability exists in the i-opener, from Netpliance. By default, the i-opener ships with the telnetd daemon running, with a set root password. As the i-opener runs QNX, it is possible that if someone gains access to any i-opener, and can decrypt the password set for root (or any account on the machine) they can gain access to every i-opener.
It has determined that the root password for these i-openers is altered upon the first connection to the Netpliance network service, and set to a different password. This password is, according to Netpliance, unique to each host. In addition, recent versions of the i-opener do not suffer from this problem at all, even prior to connection.
The core problem, of i-openers being susceptible to the password decryption problem present in QNX, is still present. Anyone gaining shell level access to an i-opener could gain the root password for the machine.
A vulnerability exists in the i-opener, from Netpliance. By default, the i-opener ships with the telnetd daemon running, with a set root password. As the i-opener runs QNX, it is possible that if someone gains access to any i-opener, and can decrypt the password set for root (or any account on the machine) they can gain access to every i-opener.
It has determined that the root password for these i-openers is altered upon the first connection to the Netpliance network service, and set to a different password. This password is, according to Netpliance, unique to each host. In addition, recent versions of the i-opener do not suffer from this problem at all, even prior to connection.
The core problem, of i-openers being susceptible to the password decryption problem present in QNX, is still present. Anyone gaining shell level access to an i-opener could gain the root password for the machine.
Exploit / POC
Netpliance i-opener Password Vulnerability
It has been reported that the password for the root account on the i-opener is "osiw$6.4" (minus the quotes). This password is changed upon connection to the Netpliance network.
It has been reported that the password for the root account on the i-opener is "osiw$6.4" (minus the quotes). This password is changed upon connection to the Netpliance network.
Solution / Fix
Netpliance i-opener Password Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
As the root password is indeed known, it may be suitable to some users to use the password to log in, and set the root password to some other password. At the same time, the passwords of all accounts on the machine should be altered, or the accounts themselves locked.
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
As the root password is indeed known, it may be suitable to some users to use the password to log in, and set the root password to some other password. At the same time, the passwords of all accounts on the machine should be altered, or the accounts themselves locked.
References
Netpliance i-opener Password Vulnerability
References:
References: