PT-2023-2331 · Rocket · Unidata+1

Ron Bowes · Published 2023-03-29 · Updated 2023-04-12 · CVE-2023-28503

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rocket Software UniData versions prior to 8.2.4 build 3003 Rocket Software UniVerse versions prior to 11.3.5 build 1001 Rocket Software UniVerse versions prior to 12.2.1 build 2002

Description The issue is related to an authentication bypass vulnerability in the do log on user() function of Rocket Software UniData and UniVerse UniRPC. This vulnerability can be exploited by a remote attacker to bypass security restrictions and execute arbitrary commands as the root user. The vulnerability can be leveraged using a special username with a deterministic password to bypass authentication checks.

Recommendations For Rocket Software UniData versions prior to 8.2.4 build 3003, update to version 8.2.4 build 3003 or later to resolve the issue. For Rocket Software UniVerse versions prior to 11.3.5 build 1001, update to version 11.3.5 build 1001 or later to resolve the issue. For Rocket Software UniVerse versions prior to 12.2.1 build 2002, update to version 12.2.1 build 2002 or later to resolve the issue. As a temporary workaround, consider restricting access to the do log on user() function until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Improper Authentication

Weakness Enumeration

CWE-798

CWE-287

Related Identifiers

BDU:2023-02096

CVE-2023-28503

Affected Products

Unidata

Universe

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/unidata_udadmin_auth_bypass.rb · Exploit
• https://osv.dev/vulnerability/CVE-2023-28503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28503 · Security Note
• https://bdu.fstec.ru/vul/2023-02096 · Security Note
• https://rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed · Note
• https://t.me/cibsecurity/61150 · Telegram Post
• http://packetstormsecurity.com/files/171854/Rocket-Software-Unidata-udadmin_server-Authentication-Bypass.html · Note