oss-sec mailing list archives
Re: FreeNAS default blank password
From: Kurt Seifried <kseifried () redhat com>
Date: Sun, 17 Aug 2014 21:33:21 -0600
It's one thing to have a default password (that's bad), but to expose it by default to a web interface and the entire internal network/world and expose it is another thing entirely. There is no way to securely setup FreeNAS short of doing it all offline with a laptop plugged into it until you have configured and secured it (which yeah... nobody is going to do). How hard would it be to not allow any remote Web GUI access until the user accesses the text based console and sets the admin password? sigh. On 17/08/14 01:47 AM, devzero2000 wrote:
Il 17/Ago/2014 04:12 "Kurt Seifried" <kseifried () redhat com> ha scritto:So I installed the latest FreeNAS (9.2.1.7), install is simple, no options, it just drops it onto the disk you specify, you reboot, it works. By default you get a text based menu with some options (setup network/DNS/etc.), and one option is "Reset WebGUI Login Credentials". The problem is at first boot (and if you ever pick "Reset WebGUI Login Credentials") the web admin has a blank password, anyone that can access it can set the admin password and then use the web GUI to fire up a root shell (there's a nice little web shell command line). So an attacker can easily race the admin to the WebGUI, set a new password, login as root, setup a backdoor, then reset the WebGUI password so it's blank again and the admin would be none the wiser (log files won't help because the attacker has root can can easily sanitize them). There is no way from the text GUI to set the Web GUI admin password. I don't think there is even a CLI tool to set the web GUI password (I can't find it easily). Either way, does this deserve a CVE? Forcing a user to set the admin Web GUI password through the Web GUI, meaning it must be exposed to some degree prior to securing it. My understanding is default/blank admin credentials now == CVE. Thanks.Many device have a "default" password on first install that everyone know. For me "blank" password or "admin admin" are equal as security risk. I have missed something ? Best regards-- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- FreeNAS default blank password Kurt Seifried (Aug 16)
- Re: FreeNAS default blank password Kurt Seifried (Aug 16)
- Re[2]: FreeNAS default blank password Dolev Farhi (Aug 17)
- Re: FreeNAS default blank password devzero2000 (Aug 17)
- Re: FreeNAS default blank password Kurt Seifried (Aug 17)
- Re: FreeNAS default blank password cve-assign (Aug 19)
- Re: Re: FreeNAS default blank password Pierre Schweitzer (Aug 19)
- Re: FreeNAS default blank password Kurt Seifried (Aug 16)