PT-2015-4286 · Microsoft+3 · Windows+3

Stefan Viehböck · Published 2015-01-08 · Updated 2015-01-08 · CVE-2014-9576

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions VDG Security SENSE (formerly DIVA) version 2.3.13

Description The issue allows remote attackers to obtain access due to hardcoded passwords for certain accounts. Specifically, the passwords ArpaRomaWi for the root Postgres account, and !DVService for the postgres and NTP Windows user accounts are hardcoded.

Recommendations For VDG Security SENSE (formerly DIVA) version 2.3.13, consider changing the hardcoded passwords ArpaRomaWi and !DVService for the root Postgres, postgres, and NTP Windows user accounts to unique, secure passwords to prevent unauthorized access.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-9576

Affected Products

Ntp

Postgres

Vdg Security Sense

Windows

References · 4

• 🔥 http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Dec/76 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9576 · Security Note