Cisco Common Service Platform Collector - Hardcoded Credentials (CVE-2019-1723)

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="27"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#28">By Date</a>
<a href="29"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="27"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#28">By Thread</a>
<a href="29"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">Cisco Common Service Platform Collector - Hardcoded	Credentials (CVE-2019-1723)</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: David Coomber &lt;davidcoomber.infosec () gmail com&gt;


<em>Date</em>: Wed, 13 Mar 2019 18:06:50 -0400


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">Cisco Common Service Platform Collector - Hardcoded Credentials (CVE-2019-1723)
--
<a rel="nofollow" href="https://www.info-sec.ca/advisories/Cisco-Collector.html">https://www.info-sec.ca/advisories/Cisco-Collector.html</a>

Overview

"The Cisco Common Service Platform Collector (CSPC) is an SNMP-based
tool that discovers and collects information from the Cisco devices
installed on your network. The CSPC software provides an extensive
collection mechanism to gather various aspects of customer device
data. Information gathered by the collector is used by several Cisco
Service offers, such as Smart Net Total Care, Partner Support Service,
and Business Critical Services. The data is used to provide inventory
reports, product alerts, configuration best practices, technical
service coverage, lifecycle information, and many other detailed
reports and analytics for both the hardware and operating system (OS)
software."

(<a rel="nofollow" href="https://www.cisco.com/c/en/us/support/cloud-systems-management/common-services-platform-collector-cspc/products-installation-guides-list.html">https://www.cisco.com/c/en/us/support/cloud-systems-management/common-services-platform-collector-cspc/products-installation-guides-list.html</a>)

Issue

The Cisco Common Service Platform Collector (version 2.7.2 through
2.7.4.5 and all releases of 2.8.x prior to 2.8.1.2) contains hardcoded
credentials.

Impact

An attacker able to access the collector via SSH or console could use
the hardcoded credentials to gain a shell on the system and perform a
range of attacks.

Timeline

February 14, 2019 - Notified Cisco via psirt () cisco com
February 14, 2019 - Cisco assigned a case number
February 18, 2019 - Cisco confirmed the vulnerability
February 20, 2019 - Cisco provided a tentative 60 day resolution timeline
February 21, 2019 - Provided comments on the proposed timeline
March 11, 2019 - Cisco advised that the issue has been resolved and
that a security advisory will be published on March 13, 2019

Solution

Upgrade to Common Service Platform Collector 2.7.4.6 or later
Upgrade to Common Service Platform Collector 2.8.1.2 or later

<a rel="nofollow" href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv</a>

Acknowledgements

Thanks to the Cisco PSIRT for their timely response

_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a>

</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="27"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#28">By Date</a>
<a href="29"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="27"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#28">By Thread</a>
<a href="29"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>Cisco Common Service Platform Collector - Hardcoded	Credentials (CVE-2019-1723)</strong> <em>David Coomber (Mar 16)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>