[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
\n
The following command will download the idefix.pkg file advertised by TCP port 4045:
# rsync rsync:\/\/[::ffff:10.10.10.10]:4043\/idefix\/idefix.pkg .<\/p>\n
Using binwalk, the file is identified as a firmware package:
# binwalk idefix.pkg<\/p>\n<\/div>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]DECIMAL HEXADECIMAL DESCRIPTION
\n--------------------------------------------------------------------------------
\n3487 0xD9F PEM certificate
\n7324 0x1C9C Executable script, shebang: \"\/bin\/sh\"
\n13549 0x34ED Unix path: \/sys\/class\/i2c-adapter\/i2c-4\/4-0054\/eeprom@101:16
\n13613 0x352D Unix path: \/sys\/class\/i2c-adapter\/i2c-4\/4-0054\/eeprom@96:5
\n13672 0x3568 Unix path: \/sys\/class\/gpio\/gpio137\/value
\n13808 0x35F0 Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 44345388 bytes, 5207 inodes, blocksize: 131072 bytes, created: 2018-08-14 13:16:20
\n44361273 0x2A4E639 uImage header, header size: 64 bytes, header CRC: 0x850DC982, created: 2018-01-22 11:38:34, image size: 210044 bytes, Data Address: 0x80E80000, Entry Point: 0x80E80000, data CRC: 0xEEA65CCC, OS: Firmware, CPU: ARM, image type: Firmware Image, compression type: none, image name: \"CISCO firmware 32\"
\n44496781 0x2A6F78D CRC32 polynomial table, little endian
\n44505174 0x2A71856 Android bootimg, kernel size: 1684103680 bytes, kernel addr: 0x616D6920, ramdisk size: 1830839655 bytes, ramdisk addr: 0x63696761, product name: \"oo long\"
\n44607241 0x2A8A709 CRC32 polynomial table, little endian
\n44612405 0x2A8BB35 uImage header, header size: 64 bytes, header CRC: 0xC37A01BA, created: 2018-06-05 12:33:35, image size: 20337280 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xFCCAACDC, OS: Linux, CPU: ARM, image type: RAMDisk Image, compression type: gzip, image name: \"CISCO ramdisk 20180605-3a15e0444CertISW\"
\n44613317 0x2A8BEC5 gzip compressed data, from Unix, last modified: 2018-06-05 12:33:25
\n64949749 0x3DF0DF5 uImage header, header size: 64 bytes, header CRC: 0x1D587465, created: 2018-06-05 12:33:41, image size: 3791880 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xC48327A1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: \"CISCO kernel 20180605-3a15e04445CertISW\"
\n64967148 0x3DF51EC gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
\n68741741 0x418EA6D Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 20941005 bytes, 878 inodes, blocksize: 131072 bytes, created: 2018-06-05 12:51:34
\n89684647 0x5587AA7 Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 553758 bytes, 192 inodes, blocksize: 131072 bytes, created: 2018-08-14 13:10:39<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\"]<\/p>\n
\n
\n
\n
Please note that at the point of this writing, usd AG has not performed any additional firmware analysis.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
\n
\n
Fix<\/h3>\n
Enable authentication for the rsync service or disable it if possible.<\/span><\/p>\n<\/h3>\nTimeline<\/h3>\n\n- 2018-10-31 Advisory has been sent to psirt@cisco.com<\/li>\n
- 2018-11-07 Cisco states that they they do not consider this to be an exposure<\/li>\n
- 2018-11-09 extended public disclosure deadline to 2019-01-23<\/li>\n
- 2019-01-23 Security advisory released<\/li>\n<\/ul>\n
<\/h3>\nCredits<\/h3>\n
This security vulnerability was discovered by Marcus Gruber and Maximilian Boehner of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2018-0035 | Cisco Unified Communications Manager (CallManager)\/11.5.1.15900-18 (likely in all versions) Advisory ID: usd-2018-0035CVE Number: N\/AAffected Product: Unified Communications ManagerAffected Version: 11.5.1.15900-18 (likely in all versions)Vulnerability Type: Exposure of Sensitive Configuration DataSecurity Risk: MediumVendor URL: https:\/\/www.cisco.comVendor Status: \u201eis not considered to be an exposure\u201c Description usd discovered that Cisco SX20 devices allow attackers on the […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16589","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16589"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16589\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}