oss-security - RE: Two more ZoneMinder that need CVE

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <FC72FC641B949240B947AC6F1F83FBAF06981072@IMCMBX01.MITRE.ORG>
Date: Thu, 21 Feb 2013 20:03:24 +0000
From: "Christey, Steven M." <coley@...re.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: security curmudgeon <jericho@...rition.org>
Subject: RE: Two more ZoneMinder that need CVE

Actually, CVE covers default accounts and passwords, although known passwords from 1999 and earlier are not covered.

While this is arguably "configuration," in 2013, products are expected to have other mechanisms of securing themselves out of the box, such as forcing a credentials change during installation, plus there is usually a race condition between when the product is installed and when the administrator changes the credentials.

- Steve

-----Original Message-----
From: Kurt Seifried [mailto:kseifried@...hat.com] 
Sent: Thursday, February 21, 2013 2:53 PM
To: oss-security@...ts.openwall.com
Cc: security curmudgeon
Subject: Re: [oss-security] Two more ZoneMinder that need CVE

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/21/2013 12:10 PM, security curmudgeon wrote:
> 
> re: Kurt's response about ZoneMinder: 
> http://seclists.org/oss-sec/2013/q1/369
> 
> OSVDB has two more ZoneMinder issues that do not have CVE:
> 
> 74198      2011-08-01     ZoneMinder index.php view Parameter
> Traversal Local File Inclusion

I think this is the CVE I Just assigned.

> 89546      2009-02-09     ZoneMinder Multiple Default Credentials

By default, ZoneMinder installs with default user credentials
(username/password combination). The 'zmuser' account has a password
of 'zmpass' and the 'admin' account has a password of 'admin', both of
which are publicly known and documented. This allows remote attackers
to trivially access the program or system and gain privileged access.

so it doesn't qualify for a CVE.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRJnsQAAoJEBYNRVNeJnmTatsP/Rn0uyabjN7rOB+mlDBGoL7K
Qo00ZZrdRQGVrswWnFgsaZqJYdbuGNi3Mwe9RQIZ0x8YvRH+8z4UCJ95OqtBqgxf
Ff+Osgd7op317skAQjspqV9d6My5v9HQHeT3bBz9PpqMIXTKqFG8VfgELvkQRfOa
AhFUJX04pbX9tWCDZ6xxfl6Kd+JsYpAIk34+d2DaRhXPEBouN0fBKxUo/SlRY6jW
jOXr7P9nNlS9M6CgibCTCafPAoufeU5auT5YWI7sMsr0YYTi8cT/qiw4iEGorVxI
aB4PsjldKnY3a+mIkIwEHPFhPqj/jkhVaNdO76f/JCAzyRaG+tc/rNeiC5GqAU/8
XDWEziJLZntwdtQS7SaraS5Re3ApNH1pMn6jx/zDNe+0ubpez6GBZmcpe3ZnfeB1
tJpX2exWvoIBJO59LSxtIgapsWR8WjZucx+H2NI9d4YirFpoaT8qhIp+yRIuXzkn
uD97VVE3xG6I8JwsJCyxRD4zhFxVG8Icily5MQhmd1iPXAb/D+wblfrRgAr2M/ay
bV2snuxBayPKgY8UJxSHI99U55euK66uiWKE62qNVzcz7H9ny9TKXxGD2CLwnUR4
MTWn0GGjtf1ULHzxhX0WYGiR1cNvC7uZ5awGvzZqK3g8/wplVdX4sUW5o8dPwpK9
/iGY57kibh/YPtCiWQM9
=yYZ4
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.