Security hole in CAT OS ?

Unanswered Question
Jun 12th, 2007
User Badges:

I have several CATOS devices in my network and running CAT OS 8.5.2 and I have TACACS and ssh enabled. I have just found out that I'm able to login to any CATOS device using a username/password ingres/ingres. Has anyone seen this behavior, any solution to stop this?

Thanks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 1 (1 ratings)
Loading.
fmeetz Tue, 06/19/2007 - 03:36
User Badges:
  • Bronze, 100 points or more

Security hole in CAT OS can be avoid by reconfigure your network and disable ssh. Also, if end systems are allowed to register arbitrary addresses via ILMI, including addresses that do not match the ILMI prefixes used on the interface, a security hole may be opened.



nawas Tue, 06/19/2007 - 06:57
User Badges:

Thank you for your reply but our management doesn't want to disable ssh and what you mentioned about ILMI, we are not even using that. We have differnet flavor of switches purely used for LAN switching.

andrew.burns Wed, 06/20/2007 - 04:17
User Badges:
  • Gold, 750 points or more

Hi,


How is your tacacs server configured - does it do a lookup on AD or other external database? Does this username/password combination exist there?


HTH

Andrew.

nawas Wed, 06/20/2007 - 05:02
User Badges:

It uses username/password configured inside the ACS. I do however have some users which authenticate to NT domain but user ingres/ingres is not configured anywhere either internal or external database.

andrew.burns Fri, 06/22/2007 - 03:02
User Badges:
  • Gold, 750 points or more

Hi,


Either it's locally configured (which you can see just by looking in the config) or it'll be configured externally *somewhere* (which you should be able to verify by looking in the ACS logs).


HTH

Andrew.


Actions

This Discussion