Vulnerability Note VU#446403

AirSpan Base Station Distribution Unit remote access vulnerability

The base station is highly modular in design and is composed of two main components: the all outdoor Base Station Radios (BSR) and the indoor Base Station Distribution Unit (BSDU). Each base station could contain up to 12 BSRs, depending on the amount of available spectrum. Each BSR is connected to the BSDU via a 100BaseT interface operating over a Cat5 cable which carries both data and power.

AirSpan BSDU has a serious security hole, which allows anyone to get remote access to device with root privileges using undocumented telnet access that is on by default. This is possible because all BSDUs share the same root password

Change the default password on affected devices. See AirSpan Product Bulletin PB/ASM/2008/015 Rev A for more information.
Restrict access

Restrict access to the web telnet interface to trusted networks. If possible, configure management and transit networks for separate VLANs, or restrict access to the device using IP access lists.

Systems Affected

http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=30263
http://www.airspan.com/products_sub_micromax.htm
http://airspan4wimax.googlepages.com/
http://grouper.ieee.org/groups/802/16/
http://en.wikipedia.org/wiki/WiMAX

Credit

Information in this report was provided by the AirSpan WiMAX MicroMAX website.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.