There is a vulnerability in the Beck IPC@CHIP that allows an attacker to gain access to the device.
The Beck IPC@CHIP is a single chip embedded webserver. This device also contains an ftp server that is configured by default to allow anonymous access. Additionally, the device grants full administrative access to any user who logs in as an anonymous user. Because there is no password set by default for anonymous login, a malicious user can connect to the service and do anything the legitimate system administrator could do logged in via ftp.
Unless the administrator changes the default settings on the Beck IPC@CHIP, an attacker can connect to the ftp service, log in as an anonymous user, gain superuser privileges, and do anything the administrator could do if they were logged in via ftp.
The CERT/CC is currently unaware of a practical solution to this problem.
Change the default settings on the ftp server to now allow anonymous access.
This vulnerability was discovered by Sentry Research Labs.
This document was written by Ian A. Finlay.
|Date First Published:||2001-09-26|
|Date Last Updated:||2001-09-26 17:52 UTC|