CVE-2019-5021 : mot de passe racine NULL codé en dur trouvé dans Alpine Linux Docker Images
A Hard-Coded NULL root user password vulnerability was found in Alpine Linux Docker Images from December 2015’s 3.3 version onward. Users are encouraged to disable the root user, or any services that utilize the system shadow file as an authentication database.
Contexte
In November 2015, a bug in Alpine Linux Docker Images was patched to prevent the /etc/shadow file from accepting a NULL password for the root user. However, eight days later, an update was pushed to the Alpine Linux project that accidentally removed this fix. Since that time, all versions of Alpine Linux from 3.3 to 3.9 have accepted a NULL password for the root user if services like Linux PAM are running on the system, due to the usage of /etc/shadow as an authentication database.
Analyse
On May 8 2019, Cisco Talos published a disclosure for this vulnerability after reporting its findings to the Alpine Linux team. The root account is enabled by default and, unless the account is explicitly locked, affected versions will treat the root account as having a blank password.
Solution
Upgrading to the latest supported versions of Alpine Docker (3.6.5, 3.7.3, 3.8.4, 3.9.3, and edge) will fix this vulnerability.
Users are encouraged to completely disable the root account on all affected versions of Alpine Linux Docker images, if upgrading is not an option for you at this time. However, if your Alpine Linux assets aren’t using a service that treats the /etc/shadow file as a password database, this vulnerability is not exploitable even if the root account is enabled.
Identification des systèmes affectés
For Tenable customers, due to the age and nature of this vulnerability, the Unpassworded 'root' Account plugin will flag any exploitable hosts without any updates or changes to the plugin. As always, we encourage customers to include the Default Unix Accounts family in their scans for configurations that contain blank or default passwords.
Où trouver plus d'informations
Rejoignez l'équipe SRT de Tenable sur Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Articles connexes
Cybersecurity Snapshot: Find MITRE ATT&CK Complex? Need Help Mapping to It? There’s an App for That!
March 10, 2023Learn about a new tool that streamlines MITRE ATT&CK mapping. Plus, known vulnerabilities remain a major cyber risk – just ask LastPass. Also, discover why SaaS data protection remains difficult. Plus, a look at the U.S. National Cybersecurity Strategy. And much more!
The Ransomware Ecosystem: In Pursuit of Fame and Fortune
July 28, 2022The key players within the ransomware ecosystem, including affiliates and initial access brokers, work together cohesively like a band of musicians, playing their respective parts as they strive for fame and fortune.
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
July 20, 2022Having gained the industry’s attention in the first months of 2022, the LAPSUS$ extortion group has largely gone quiet. What can we learn from this extortion group’s story and tactics?
Tenable Bolsters Its Cloud Security Arsenal with Malware Detection
May 1, 2024Tenable Cloud Security is enhancing its capabilities with malware detection. Combined with its cutting-edge, agentless vulnerability-scanning technology, including its ability to detect anomalous behavior, this new capability makes Tenable Cloud Security a much more complete and effective solution. Read on to find out how.
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning