Vulnerabilities > CVE-1999-0502

• http://www.oracle.com/us/products/database/index.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502
• http://nmap.org/nsedoc/scripts/oracle-brute.html

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0651
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502

• https://wordpress.org/
• http://www.ethicalhack3r.co.uk/security/introduction-to-the-wordpress-xml-rpc-api/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502

• http://www.postgresql.org
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502
• https://hashcat.net/forum/archive/index.php?thread-4148.html

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502
• https://tools.ietf.org/html/rfc3977
• https://tools.ietf.org/html/rfc4642
• https://tools.ietf.org/html/rfc4643

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0651
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0651
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3843
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4189
• http://www.harmonysecurity.com/blog/2009/11/hp-operations-manager-backdoor-account.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4188
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0557
• http://www-01.ibm.com/support/docview.wss?uid=swg21419179
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4094
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3548
• http://tomcat.apache.org/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502

#
# (C) Tenable Network Security, Inc.
#

account = "root";
password = "xc3511";

include("compat.inc");

if (description)
{
  script_id(94400);
  script_version("1.13");
  script_cvs_date("Date: 2019/11/14");

  script_cve_id("CVE-1999-0502", "CVE-2016-1000245");

  script_name(english:"Default Password 'xc3511' for 'root' Account");
  script_summary(english:"Attempts to log into the remote host.");

  script_set_attribute(attribute:"synopsis", value:
"An administrative account on the remote host uses a known default
password.");
  script_set_attribute(attribute:"description", value:
"The account 'root' on the remote host has the default password
'xc3511'. A remote attacker can exploit this issue to gain
administrative access to the affected system.");
  script_set_attribute(attribute:"solution", value:
"Change the password or disable the account.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:TF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:T/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-1999-0502");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'SSH User Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_publication_date", value:"2016/10/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"default_account", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Default Unix Accounts");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service1.nasl", "ssh_detect.nasl", "account_check.nasl");
  script_exclude_keys("global_settings/supplied_logins_only");
  script_require_ports("Services/telnet", 23, "Services/ssh", 22);

  exit(0);
}

include("audit.inc");
include("default_account.inc");
include("global_settings.inc");

if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);

if (! thorough_tests && ! get_kb_item("Settings/test_all_accounts"))
 exit(0, "Neither thorough_tests nor 'Settings/test_all_accounts' is set.");

affected = FALSE;
ssh_ports = get_service_port_list(svc: "ssh", default:22);
foreach port (ssh_ports)
{
  port = check_account(login:account, password:password, port:port, svc:"ssh");
  if (port)
  {
    affected = TRUE;
    security_report_v4(port:port, severity:SECURITY_HOLE, extra:default_account_report());
  }
}
if(affected) exit(0);

telnet_ports = get_service_port_list(svc: "telnet", default:23);
foreach port (telnet_ports)
{
  port = check_account(login:account, password:password, port:port, svc:"telnet");
  if (port)
  {
    affected = TRUE;
    security_report_v4(port:port, severity:SECURITY_HOLE, extra:default_account_report());
  }
}
if(!affected) audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#


account = "root";
password = "admin";


include("compat.inc");


if (description)
{
  script_id(40355);
  script_version("$Revision: 1.13 $");
  script_cvs_date("$Date: 2017/11/20 15:13:56 $");

  script_cve_id("CVE-1999-0502");
 
  script_name(english:"Default Password (admin) for 'root' Account");
  script_summary(english:"Attempts to log in to the remote host.");
     
  script_set_attribute(attribute:"synopsis", value:
"The remote system can be accessed with a default administrator
account.");
  script_set_attribute(attribute:"description", value:
"The account 'root' on the remote host has the password 'admin'.
An attacker may leverage this issue to gain access, likely as an
administrator, to the affected system.

Note that DD-WRT, an open source Linux-based firmware popular on
small routers and embedded systems, is known to use these
credentials by default.");
  script_set_attribute(
    attribute:"solution", 
    value:"Change the password for this account or disable it."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'SSH User Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"default_account", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Default Unix Accounts");

  script_copyright(english:"This script is Copyright (C) 2009-2017 Tenable Network Security, Inc.");

  script_dependencie("find_service1.nasl", "ssh_detect.nasl", "account_check.nasl");
  script_require_ports("Services/telnet", 23, "Services/ssh", 22);
  script_exclude_keys("global_settings/supplied_logins_only");

  exit(0);
}

include("audit.inc");
include("default_account.inc");
include("global_settings.inc");

if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);

if (! thorough_tests && ! get_kb_item("Settings/test_all_accounts"))
 exit(0, "Neither thorough_tests nor 'Settings/test_all_accounts' is set.");

affected = FALSE;
ssh_ports = get_service_port_list(svc: "ssh", default:22);
foreach port (ssh_ports)
{
  port = check_account(login:account, password:password, port:port, svc:"ssh");
  if (port)
  {
    affected = TRUE;
    security_report_v4(port:port, severity:SECURITY_HOLE, extra:default_account_report());
  }
}
if(affected) exit(0);

telnet_ports = get_service_port_list(svc: "telnet", default:23);
foreach port (telnet_ports)
{
  port = check_account(login:account, password:password, port:port, svc:"telnet");
  if (port)
  {
    affected = TRUE;
    security_report_v4(port:port, severity:SECURITY_HOLE, extra:default_account_report());
  }
}
if(!affected) audit(AUDIT_HOST_NOT, "affected");