PT-2015-4286 · Microsoft+3 · Windows+3

Stefan Viehböck · Publicado 2015-01-08 · Atualizado 2015-01-08 · CVE-2014-9576

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions VDG Security SENSE (formerly DIVA) version 2.3.13

Description The issue allows remote attackers to obtain access due to hardcoded passwords for certain accounts. Specifically, the passwords ArpaRomaWi for the root Postgres account, and !DVService for the postgres and NTP Windows user accounts are hardcoded.

Recommendations For VDG Security SENSE (formerly DIVA) version 2.3.13, consider changing the hardcoded passwords ArpaRomaWi and !DVService for the root Postgres, postgres, and NTP Windows user accounts to unique, secure passwords to prevent unauthorized access.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-9576

Produtos afetados

Ntp

Postgres

Vdg Security Sense

Windows

Referências · 4

• 🔥 http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Dec/76 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9576 · Nota de Segurança