Allot NetEnforcer Default Accounts Password Weakness
BID:5818
Info
Allot NetEnforcer Default Accounts Password Weakness
| Bugtraq ID: | 5818 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 27 2002 12:00AM |
| Updated: | Sep 27 2002 12:00AM |
| Credit: | Vulnerability discovery credited to Bencsath Boldizsar <[email protected]>. |
| Vulnerable: |
Allot NetEnforcer 4.2.4 Allot NetEnforcer 4.2.1 Allot NetEnforcer 4.2 |
| Not Vulnerable: | |
Discussion
Allot NetEnforcer Default Accounts Password Weakness
NetEnforcer is a Quality of Service system built on a Linux distribution and custom hardware system.
By default, NetEnforcer includes three preconfigured accounts with default passwords. These account and password combinations are as follows:
root/bagabu
admin/allot
monitor/allot
The monitor account allows a remote user to gain local unprivileged access to the system, while the root and admin accounts give a user administrative access to a system.
It should also be noted that the default MySQL installation used with NetEnforcer does not allow remote access, although local users may access MySQL administrative accounts without passwords. However, unauthorized remote database access may be possible if SSH port forwarding is enabled, as it is in the default configuration of the device.
To further compound this issue, the /etc/shadow file has insecure default permissions.
NetEnforcer is a Quality of Service system built on a Linux distribution and custom hardware system.
By default, NetEnforcer includes three preconfigured accounts with default passwords. These account and password combinations are as follows:
root/bagabu
admin/allot
monitor/allot
The monitor account allows a remote user to gain local unprivileged access to the system, while the root and admin accounts give a user administrative access to a system.
It should also be noted that the default MySQL installation used with NetEnforcer does not allow remote access, although local users may access MySQL administrative accounts without passwords. However, unauthorized remote database access may be possible if SSH port forwarding is enabled, as it is in the default configuration of the device.
To further compound this issue, the /etc/shadow file has insecure default permissions.
Exploit / POC
Allot NetEnforcer Default Accounts Password Weakness
No exploit is required for this weakness.
No exploit is required for this weakness.
Solution / Fix
Allot NetEnforcer Default Accounts Password Weakness
Solution:
The vendor has released Allot NetEnforcer 4.2.4 which addresses some of the consequences of these issues. In this release, SSH port forwarding is disabled by default and the permissions on /etc/shadow are fixed. Howerver, this release does not address the existence of the default accounts, which could still potentially be used to gain unauthorized access.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The vendor has released Allot NetEnforcer 4.2.4 which addresses some of the consequences of these issues. In this release, SSH port forwarding is disabled by default and the permissions on /etc/shadow are fixed. Howerver, this release does not address the existence of the default accounts, which could still potentially be used to gain unauthorized access.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.