Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 16 Aug 2014 20:12:15 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org,
        security@...enas.org
Subject: FreeNAS default blank password

So I installed the latest FreeNAS (9.2.1.7), install is simple, no
options, it just drops it onto the disk you specify, you reboot, it works.

By default you get a text based menu with some options (setup
network/DNS/etc.), and one option is "Reset WebGUI Login Credentials".

The problem is at first boot (and if you ever pick "Reset WebGUI Login
Credentials") the web admin has a blank password, anyone that can access
it can set the admin password and then use the web GUI to fire up a root
shell (there's a nice little web shell command line).

So an attacker can easily race the admin to the WebGUI, set a new
password, login as root, setup a backdoor, then reset the WebGUI
password so it's blank again and the admin would be none the wiser (log
files won't help because the attacker has root can can easily sanitize
them).

There is no way from the text GUI to set the Web GUI admin password. I
don't think there is even a CLI tool to set the web GUI password (I
can't find it easily).

Either way, does this deserve a CVE? Forcing a user to set the admin Web
GUI password through the Web GUI, meaning it must be exposed to some
degree prior to securing it. My understanding is default/blank admin
credentials now == CVE. Thanks.


-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993


[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ