ID

VAR-200507-0043

CVE

CVE-2005-2136

TITLE

Raritan DominionSX ConsoleServer Weak security mechanism vulnerability

DESCRIPTION

Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users. Raritan Dominion SX is reportedly prone to multiple vulnerabilities. Reportedly, the server contains two default accounts that are not protected with a password. This can allow a remote attacker to gain unauthorized access to the server. Another issue can allow an attacker to potentially gain elevated privileges on an affected computer as the shadow password file is world readable. Raritan Dominion SX16, SX32, SX4, SX8, and SXA-48 are reportedly vulnerable. The researcher responsible for reporting these issues has stated that DSX32 running firmware version 2.4.6 was tested and is vulnerable to these issues. This BID will be updated when more details are available. Raritan Dominion SX Console Server is a set of serial device management software. Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 have weak security mechanisms. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Dominion SX Insecure File Permission Security Issues SECUNIA ADVISORY ID: SA15853 VERIFY ADVISORY: http://secunia.com/advisories/15853/ CRITICAL: Less critical IMPACT: Manipulation of data, Exposure of sensitive information WHERE: Local system OPERATING SYSTEM: Dominion SX http://secunia.com/product/5300/ DESCRIPTION: Dirk Wetter has reported two security issues in Dominion SX, which can be exploited by malicious, local users to disclose sensitive information, cause a DoS (Denial of Service), and potentially gain escalated privileges. 1) The default file permission of "/etc/shadow" is set to world-readable, which makes it possible to gain knowledge of the root user's password hash. 2) The default file permission of "/bin/busybox" is set to world-writable. This can be exploited to move or delete the file and potentially execute arbitrary code with another user's privileges by replacing it with a malicious file. The security issues have been reported in DSX4, DSX8, DSX16, DSX32, and DSXA-48. SOLUTION: Apply updated firmware. http://www.raritan.com/support/sup_upgrades.aspx PROVIDED AND/OR DISCOVERED BY: Dirk Wetter ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

Design Error

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Discovery is credited to Dr. Dirk Wetter.

SOURCES

LAST UPDATE DATE

2024-08-14T15:45:41.904000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE