N-Base Switch Vulnerability
BID:212
Info
N-Base Switch Vulnerability
| Bugtraq ID: | 212 |
| Class: | Access Validation Error |
| CVE: |
CVE-1999-1420 CVE-1999-1421 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 20 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | These vulnerabilities were posted to the Bugtraq mailing list on July 20, 1998 by TTSG <[email protected]> in a detailed advisory. A followup was posted on July 20, 1998 by Geoff Cummins <[email protected]>. |
| Vulnerable: |
N-Base NH3012 2.1 N-Base NH2048 1.33 N-Base NH2015 2.51 N-Base NH2012R 2.53 N-Base NH2012 2.53 |
| Not Vulnerable: |
N-Base NH3012 2.2 N-Base NH2048 1.34 N-Base NH2015 2.52 N-Base NH2012R 2.54 N-Base NH2012 2.54 |
Discussion
N-Base Switch Vulnerability
A number of vulnerabilities exist in switches produced by N-Base Communications. These vulnerabilities allow any user who can access the switch via the console port or the network to modify and alter the configuration of these switches, as well as upload arbitrary code images to these switches.
N-Base switches all contain a "backdoor" password, in order to allow users who forget their password to access the switch. This backdoor in effect eliminates all security on these switches. By entering any legitimate user name, with the password of "forgot" or "debug", the user will have the full privelege of the account being used. The debug account further allows for the modification of machine registers, which can be used to easily deny any traffic from passing through the switch.
In addition, these switches have a TFTP server built in to them that allow arbitrary hosts to upload images to them. Any attacker who accesses the switch can enable this tftp server, and use it to overwrite the running image. This could easily cause the switch to cease functioning.
A number of vulnerabilities exist in switches produced by N-Base Communications. These vulnerabilities allow any user who can access the switch via the console port or the network to modify and alter the configuration of these switches, as well as upload arbitrary code images to these switches.
N-Base switches all contain a "backdoor" password, in order to allow users who forget their password to access the switch. This backdoor in effect eliminates all security on these switches. By entering any legitimate user name, with the password of "forgot" or "debug", the user will have the full privelege of the account being used. The debug account further allows for the modification of machine registers, which can be used to easily deny any traffic from passing through the switch.
In addition, these switches have a TFTP server built in to them that allow arbitrary hosts to upload images to them. Any attacker who accesses the switch can enable this tftp server, and use it to overwrite the running image. This could easily cause the switch to cease functioning.
Solution / Fix
N-Base Switch Vulnerability
Solution:
Upgrading to a newer software revision is the only effective way to solve these security problems. Updated software is available from http://www.nbase.com. A post was sent to the Bugtraq mailing list by Geoff Cummins <[email protected]> detailing the additional security features found in the updated software. They are as follows.
set-full-sec enable (this disables the backdoor passwords)
set-sw-file XXX (where XXX is the name you want to call your SNMP software update file)
set-par-file XXX (where XXX is the name you want to call your parameters file)
set-passwd <return> (this will display a prompt to enter a new password)
set-comm read XXX (where XXX is the new read community)
set-comm write XXX (where XXX is the new write community)
These steps should secure the mentioned MegaSwitch II configurations.
For GigaFrame Switch NH3012 2.1
set-full-sec enabled
set-sw-file XXX
set-par-file XXX
set-comm read XXX
set-comm write XXX
set-passwd <return>
del-user user (By default there are two users "super", and "user". "super" has supervisor priveldges, "user" is just a default. To secure the system, you should delete the "user" account.)
Solution:
Upgrading to a newer software revision is the only effective way to solve these security problems. Updated software is available from http://www.nbase.com. A post was sent to the Bugtraq mailing list by Geoff Cummins <[email protected]> detailing the additional security features found in the updated software. They are as follows.
set-full-sec enable (this disables the backdoor passwords)
set-sw-file XXX (where XXX is the name you want to call your SNMP software update file)
set-par-file XXX (where XXX is the name you want to call your parameters file)
set-passwd <return> (this will display a prompt to enter a new password)
set-comm read XXX (where XXX is the new read community)
set-comm write XXX (where XXX is the new write community)
These steps should secure the mentioned MegaSwitch II configurations.
For GigaFrame Switch NH3012 2.1
set-full-sec enabled
set-sw-file XXX
set-par-file XXX
set-comm read XXX
set-comm write XXX
set-passwd <return>
del-user user (By default there are two users "super", and "user". "super" has supervisor priveldges, "user" is just a default. To secure the system, you should delete the "user" account.)