Vulnerability Note VU#544527

OpenELEC and RasPlex have a hard-coded SSH root password

Original Release date: 02 Feb 2016 | Last revised: 02 Feb 2016

Overview

OpenELEC and derivatives utilize a hard-coded default root password, and enable SSH root access by default.

Description

CWE-259: Use of Hard-coded Password

OpenELEC has a hard-coded root password. The root partition is by default read-only, preventing a user from changing the password once installed; furthermore, SSH access is enabled by default.

RasPlex is based on OpenELEC and therefore inherits this same problem.

According to RasPlex, "The root filesystem is read only (squashfs). This prevents the ability to change the root password, but also prevents an attacker from modifying the filesystem."

Impact

A remote attacker may gain root access to the device.

Solution

The CERT/CC is currently unaware of a full solution to this issue. Affected users may consider the following mitigations:

Disable SSH password access

Disable the use of password access to SSH, and enable SSH keys instead.

RasPlex notes that "users can simply disable SSH via the dialog if they are worried about being compromised."

Build with a different password

Developers may build their own distribution of OpenELEC or RasPlex from source and modify the root password at build time. Users should be aware however that this password is still hard-coded and may leave a user vulnerable to further attack; future password changes would require another rebuild and deployment.

Restrict network access

Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
OpenELECAffected-29 Jan 2016
RasPlexAffected-29 Jan 2016
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 8.5 E:POC/RL:U/RC:UR
Environmental 2.1 CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Aidan Samuel for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs: Unknown
  • Date Public: 02 Feb 2016
  • Date First Published: 02 Feb 2016
  • Date Last Updated: 02 Feb 2016
  • Document Revision: 24

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.