7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
0.002 Low
EPSS
Percentile
59.1%
The hashing algorithm that is used in the standard authentication API for VxWorks is susceptible to collisions. An attacker can brute force a password by guessing a string that produces the same hash as a legitimate password.
An attacker with a known username and access to a service (telnet, rlogin or FTP) that uses the standard authentication API (loginDefaultEncrypt (), part of loginLib) can brute force the password in a relatively short period of time. Since the hashing algorithm is susceptible to collisions, the actual password does not have to be found, just a string that produces the same hash.
For instance, when the default ātarget/passwordā login example is used, āy{{{{{kSā hashes to the same string as āpasswordā. It is thus possible to login using both āpasswordā and āy{{{{{kSā as the passwords for the user ātargetā.
Additional information can be found in ICS-CERT advisory ICSA-10-214-01 and on the Metasploit Blog.
An attacker can brute force a correct password by guessing a string that produces the same hash and access the relevant service as the known user.
Vendors which use VxWorks in their products should not use the default hashing algorithm in standard authentication API (loginDefaultEncrypt()). A trusted authentication API should be used instead. It can be installed by means of the loginEncryptInstall() loginLib hook.
In addition, and so as to avoid registration of the default ātargetā/āpasswordā credentials at init time, the LOGIN_USER_NAME and LOGIN_USER_PASSWORD project parameters/#defines should be set to empty strings (so that no user is registered using the default encryption routine). Only after the new encryption routine is registered should new users be added to the system.
loginEncryptInstall allows the user to install a custom encryption routine. The custom routine <rtn> must be of the following form:
STATUS encryptRoutine
(
char *password, /* string to encrypt */
char *encryptedPassword /* resulting encryption */
)
The <encryptedPassword> string length should be no more than :
+ VxWorks 6.4 and below: 80 characters
+ VxWorks 6.5 and above: 128 characters
When a custom encryption routine is installed, a host version of this routine must be written to replace the tool vxencrypt in host/<hostOs>/bin.
Appendix #1 shows example code making use of loginEncryptInstall() to set a custom encryption routine. Depending on the VxWorks version used, either SHA-512 or SHA-256 are used.
DISCLAIMER: The following example code was provided by Wind River Systems. It is for demonstration purposes only and should not be used as is.
APPENDIX #1
/* Sample loginEncryptInstallCode() */
/* includes */
#include <vxWorks.h>
#include <errnoLib.h>\t/* for errnoGet API */
#include <fcntl.h>\t/* for open API */
#include <stdio.h>\t/* for sprintf API */
#include <string.h>\t/* for string handling */
#include <unistd.h>\t/* for close API */
#include <loginLib.h> /* library under test */
#include <sysSymTbl.h>\t/* for sySymTbl variable */
/* globals */
/*
* SHA-512 and SHA-256 digests corresponding to the 'vincent' string.
* VxWorks 6.4 and below use SHA-256 because of the 80 chars
* loginEncryptInstall() digest limit, while post 6.5 versions use SHA-512.
*/
#if ((_WRS_VXWORKS_MAJOR == 6) && (_WRS_VXWORKS_MINOR > 4))
char * cryptSha = "38256fbe4e80d9ffd355409f36238ae18e62c668208c259e60"
\t\t "ca323ab47cf55b8656e88e56593d531b250aae2c35376b387d"
\t\t "83ade5e3e8b6c042133b97030fa4";
char * shaIdent = "SHA-512";
#else
char * cryptSha = "65c3f75641b22925c737ca657b126cd68c39e423349d43031c"
\t\t "f9a3b9a18cee1f";
char * shaIdent = "SHA-256";
#endif
/* locals */
LOCAL STATUS fixed_sha (char* password, char* encryptedpassword);
/*******************************************************************************
*
* loginEncryptInstallExample - register and use a custom encryption routine
*
* RETURNS: N/A
*/
STATUS loginEncryptInstallExample (void)
{
char* name = "vincent";
char* passwd = "vincent";
STATUS status = ERROR;
/* Register our new encryption routine */
loginEncryptInstall (fixed_sha, 0);
printf ("Registered %s encryption routine.\", shaIdent);
/* Add a new user using this encryption routine */
if (loginUserAdd (name, cryptSha) != OK)
{
\tprintf ("Unable to add new user to system using %s encryption"
\t\t"routine [errno = %#x].\", shaIdent, errnoGet ());
return ERROR;
}
else
{
\t/* Launch the verification process */
\tif (loginUserVerify (name, passwd) != OK)
\t {
\t printf ("Successfully registered and added a new user "
\t\t "with custom encryption routine but password "
\t\t "check failed [errno = %#x].\", errnoGet ());
\t goto cleanup;
\t }
\telse
\t {
\t printf ("Successfully used custom encryption routine "
\t\t "(routine registration, user creation and "
\t\t "verification).\");
\t }
\t}
status = OK;
cleanup:
/* Remove user and module; unregister routine */
if (loginUserDelete (name, passwd) != OK)
\t{
\tprintf ("There was a problem while trying to delete the "
\t\t"newly added user during cleanup [errno = " "%#x].\",
\t\terrnoGet ());
\tstatus = ERROR;
\t}
loginEncryptInstall ((FUNCPTR) loginDefaultEncrypt, 0);
return status;
}
/******************************************************************************
* fixed_sha - returns a fixed SHA digest
*
* RETURNS: Always OK
*/
LOCAL STATUS fixed_sha
(
char* password,
char* encryptedpassword
)
{
/*
* IMPORTANT : This test routine should be replaced by a real SHA
* generator. Because of the fixed digest, the current version does not
* perform actual user validation (i.e all passwords are accepted for user
* 'vincent').
*/
strcpy (encryptedpassword, cryptSha);
return OK;
}
Restrict access
Appropriate firewall rules should be implemented to restrict access to any services that use the standard authentication API.
Disable services
Services such as FTP or telnet should be disabled if not needed.
Monitor access
IDS signatures should be implemented to detect brute force attacks to services that use the standard authentication API.
840249
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: June 29, 2010 Updated: August 04, 2010
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 03, 2010 Updated: August 02, 2010
Affected
Wind River has analyzed VU#840249, and determined that all versions of VxWorks that use the default hash algorithm (loginDefaultEncrypt) in loginLib can be vulnerable. VxWorks has a very strong track record of offering secure products and Wind River is committed to active threat monitoring, rapid assessment, threat prioritization, expedited remediation, response and proactive customer contact. Customers are encouraged to follow one of the remediation actions outlined in the SOLUTION section of the vulnerability post. When released, VxWorks 6.9 will further strengthen the default hash algorithm.
Registered users can access Wind Riverās online support for more information by following the link below. Registered users will also find patches to remove the 80 characters limitation for encrypted password string length on VxWorks versions 5.5.1 through 6.4.
<https://support.windriver.com/olsPortal/faces/maintenance/downloadDetails.jspx?contentId=033709>
Or contact Wind River technical support for more information:
<http://windriver.com/support/>
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 09, 2010
Not Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 14, 2010 Updated: August 04, 2010
Not Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 06, 2010
Not Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: July 07, 2010 Updated: August 02, 2010
Statement Date: July 15, 2010
Not Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Rockwell Automation has indicated that they are not affected by this vulnerability.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23840249 Feedback>).
Notified: June 29, 2010 Updated: April 29, 2011
Not Affected
Security Advisory Report - OBSO-1007-01
Wind River VxWorks: weak default hashing algorithm in standard authentication API (loginLib)
Creation Date: 2010-07-22
Last Update: 2010-07-22
Summary
Wind River has published a security advisory, which states, that the default hashing algorithm that is used in the standard authentication API for VxWorks is susceptible to collisions. An attacker can brute force a password by guessing a string that produces the same hash as a legitimate password.
Vulnerability Details
An attacker with a known username and access to a service (telnet, rlogin or FTP) that uses the standard authentication API (loginDefaultEncrypt (), part of loginLib) can brute force the password in a relatively short period of time. Since the hashing algorithm is susceptible to collisions, the actual password does not have to be found, just a string that produces the same hash. For instance, when the default ātarget/passwordā login example is used, āy{{{{{kSā hashes to the same string as āpasswordā. It is thus possible to login using both āpasswordā and āy{{{{{kSā as the passwords for the user ātargetā.
Impact:
Because an attacker can brute force a correct password by guessing a string that produces the same hash and access the relevant service as a known user. Applications such as rlogin, telnet, and FTP rely on loginLib for security, and can be used to gain access to the device.
Affected Products
No products from Siemens Enterprise Communications are affected.
The following products include VxWorks as operating system, but none of them make use of the standard login library:
* HiPath 4000
* HiPath 3000 (HG 1500)
* HiPath Wireless Convergence
* optiPoint 410/420 HFA/SIP
* RG 8700
Recommended Actions
None.
References
Revision History
2010-07-22 Initial Release
Contact and Disclaimer
OpenScale Baseline Security Office
[email protected]
Ā© Siemens Enterprise Communications GmbH & Co KG 2010
Siemens Enterprise Communications GmbH & Co. KG is a Trademark Licensee of Siemens AG
The information provided in this document is subject to change without notice. Siemens Enterpise Communications GmbH & Co KG (SEN) assumes no responsibility for any errors that may appear in this document, and it does not affect your current support agreements with SEN. Any trademarks referenced in this document are the property of their respective owners.
-āEnd Vendor Statement-----------------------------------------
The above information was provided by the vendor.
Notified: June 29, 2010 Updated: August 04, 2010
Not Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 14, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 14, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: August 03, 2010 Updated: August 03, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: August 03, 2010 Updated: August 03, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: July 14, 2010 Updated: July 14, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: June 29, 2010 Updated: August 04, 2010
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
View all 55 vendors __View less vendors __
Group | Score | Vector |
---|---|---|
Base | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Temporal | 9.5 | E:H/RL:W/RC:C |
Environmental | 9.5 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
Thanks to HD Moore for reporting this vulnerability.
This document was written by Jared Allar.
CVE IDs: | CVE-2010-2967 |
---|---|
Severity Metric: | 23.63 Date Public: |
blogs.windriver.com/chauhan/2010/08/vxworks-secure.html
cvk.posterous.com/how-to-crack-vxworks-password-hashes
cwe.mitre.org/data/definitions/327.html
cwe.mitre.org/data/definitions/798.html
cwe.mitre.org/data/definitions/916.html
newsoft-tech.blogspot.com/2010/09/follow-up-on-vxworks-issue.html
www.us-cert.gov/control_systems/pdf/ICSA-10-214-01_VxWorks_Vulnerabilities.pdf
community.rapid7.com/community/metasploit/blog/2010/08/02/shiny-old-vxworks-vulnerabilities
support.windriver.com/olsPortal/faces/maintenance/downloadDetails.jspx?contentId=033709