Overview
The administration tools (i.e. ookillls, oostopams, etc) for Objectivity/DB do not require authentication for local or remote operation.
Description
Objectivity/DB comes with several administration tools for database maintenance. By design, these tools do not require authentication. An attacker can emulate the functionality of the administration tools with a custom script as well. |
Impact
An unauthenticated remote attacker can run commands on the database server. Confidentiality, Integrity, and Availability of the data can be compromised by the attacker. |
Solution
We are currently unaware of a practical solution to this problem. |
Appropriate firewall rules should be implemented to restrict remote access to only trusted sources or blocked entirely and administration only done locally. TCP ports 6779 and 6780 should be filtered. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | N/A | N/A |
| Temporal | N/A | N/A |
| Environmental | N/A |
References
Acknowledgements
Thanks to Jeremy Brown for reporting this vulnerability.
This document was written by Jared Allar.
Other Information
| CVE IDs: | None |
| Severity Metric: | 5.52 |
| Date Public: | 2011-01-13 |
| Date First Published: | 2011-01-13 |
| Date Last Updated: | 2011-01-13 19:28 UTC |
| Document Revision: | 11 |