{"id":6280,"date":"2017-01-23T14:08:15","date_gmt":"2017-01-23T22:08:15","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-131\/"},"modified":"2017-01-23T14:08:15","modified_gmt":"2017-01-23T22:08:15","slug":"news-131","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-131\/","title":{"rendered":"SSD Advisory \u2013 Cisco MSE Preauthentication Remote Code Execution"},"content":{"rendered":"

<\/p>\n

\n

Vulnerabilities Summary<\/strong>
Cisco Mobile Services Engine (MSE) is a platform that helps organizations increase visibility into the network, customize location-based mobile services, and strengthen security. The following advisory describes Cisco MSE Pre-Authentication Code Execution (Cisco MSE version 8.0.100.0).<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

Vendor response<\/strong>
The vendor has released Mobility Services Engine patches (November 2015) to address the vulnerabilities, advisory can be found here<\/a> and here<\/a><\/p>\n

<\/span><\/p>\n

Vulnerability Details<\/strong>
Cisco MSE is available in both a physical or virtual appliance. The virtual appliance by default runs a network-accessible SSH server. There is an undocumented user account on the system that allows remote shell access using a static password set upon install. Using this bug in combination with a local privilege escalation vulnerability allows a remote user to gain root privileges on the appliance.<\/p>\n

There are two configured user accounts on the appliance, the root user and another account named \u201coracle\u201d. Upon install, the root user\u2019s password is set by an administrator, oracle\u2019s account is undocumented. During the installation of the following files:<\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n