Overview
There is a vulnerability in the Beck IPC@CHIP that allows an attacker to gain access to the device.
Description
The Beck IPC@CHIP is a single chip embedded webserver. This device also contains an ftp server that is configured by default to allow anonymous access. Additionally, the device grants full administrative access to any user who logs in as an anonymous user. Because there is no password set by default for anonymous login, a malicious user can connect to the service and do anything the legitimate system administrator could do logged in via ftp. |
Impact
Unless the administrator changes the default settings on the Beck IPC@CHIP, an attacker can connect to the ftp service, log in as an anonymous user, gain superuser privileges, and do anything the administrator could do if they were logged in via ftp. |
Solution
The CERT/CC is currently unaware of a practical solution to this problem. |
Change the default settings on the ftp server to now allow anonymous access. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was discovered by Sentry Research Labs.
This document was written by Ian A. Finlay.
Other Information
| CVE IDs: | None |
| Severity Metric: | 18.75 |
| Date Public: | 2001-05-24 |
| Date First Published: | 2001-09-26 |
| Date Last Updated: | 2001-09-26 17:52 UTC |
| Document Revision: | 18 |