CVE-2019-5021: Senha raiz codificada NULA encontrada nas imagens do docker do Alpine Linux
A Hard-Coded NULL root user password vulnerability was found in Alpine Linux Docker Images from December 2015’s 3.3 version onward. Users are encouraged to disable the root user, or any services that utilize the system shadow file as an authentication database.
Contexto
In November 2015, a bug in Alpine Linux Docker Images was patched to prevent the /etc/shadow file from accepting a NULL password for the root user. However, eight days later, an update was pushed to the Alpine Linux project that accidentally removed this fix. Since that time, all versions of Alpine Linux from 3.3 to 3.9 have accepted a NULL password for the root user if services like Linux PAM are running on the system, due to the usage of /etc/shadow as an authentication database.
Análise
On May 8 2019, Cisco Talos published a disclosure for this vulnerability after reporting its findings to the Alpine Linux team. The root account is enabled by default and, unless the account is explicitly locked, affected versions will treat the root account as having a blank password.
Solução
Upgrading to the latest supported versions of Alpine Docker (3.6.5, 3.7.3, 3.8.4, 3.9.3, and edge) will fix this vulnerability.
Users are encouraged to completely disable the root account on all affected versions of Alpine Linux Docker images, if upgrading is not an option for you at this time. However, if your Alpine Linux assets aren’t using a service that treats the /etc/shadow file as a password database, this vulnerability is not exploitable even if the root account is enabled.
Identificação de sistemas afetados
For Tenable customers, due to the age and nature of this vulnerability, the Unpassworded 'root' Account plugin will flag any exploitable hosts without any updates or changes to the plugin. As always, we encourage customers to include the Default Unix Accounts family in their scans for configurations that contain blank or default passwords.
Obtenha mais informações
Junte-se à equipe de resposta de segurança da Tenable na Tenable.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Artigos relacionados
Cybersecurity Snapshot: Find MITRE ATT&CK Complex? Need Help Mapping to It? There’s an App for That!
March 10, 2023Learn about a new tool that streamlines MITRE ATT&CK mapping. Plus, known vulnerabilities remain a major cyber risk – just ask LastPass. Also, discover why SaaS data protection remains difficult. Plus, a look at the U.S. National Cybersecurity Strategy. And much more!
The Ransomware Ecosystem: In Pursuit of Fame and Fortune
July 28, 2022The key players within the ransomware ecosystem, including affiliates and initial access brokers, work together cohesively like a band of musicians, playing their respective parts as they strive for fame and fortune.
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
July 20, 2022Having gained the industry’s attention in the first months of 2022, the LAPSUS$ extortion group has largely gone quiet. What can we learn from this extortion group’s story and tactics?
Cybersecurity Snapshot: New Guide Explains How To Assess if Software Is Secure by Design, While NIST Publishes GenAI Risk Framework
May 10, 2024Is the software your company wants to buy securely designed? A new guide outlines how you can find out. Meanwhile, a new NIST framework can help you assess your GenAI systems’ risks. Plus, a survey shows a big disconnect between AI usage (high) and AI governance (low). And MITRE’s breach post-mortem brims with insights and actionable tips. And much more!
CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
May 9, 2024Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning