Exploit-DB #16100
Description: Tandberg E & EX & C Series Endpoints - Default Root Account Credentials
Type: remote
Platform: hardware
Date: 2011-02-02
Author: Cisco Security

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Cisco Security Advisory: Default Credentials for Root Account on
Tandberg E, EX and C Series Endpoints

Advisory ID: cisco-sa-20110202-tandberg

Revision 1.0

For Public Release 2011 February 2 1600 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

Tandberg C Series Endpoints and E/EX Personal Video units that are
running software versions prior to TC4.0.0 ship with a root
administrator account that is enabled by default with no password. An
attacker could use this account in order to modify the application
configuration or operating system settings.

Resolving this default password issue does not require a software
upgrade and can be changed or disabled by a configuration command for
all affected customers. The workaround detailed in this document
demonstrates how to disable the root account or change the password.

This advisory is posted at 
http://www.cisco.com/warp/public/707/cisco-sa-20110202-tandberg.shtml.

Affected Products
=================

Vulnerable Products
+------------------

This vulnerability affects Tandberg C Series Endpoints and E/EX
Personal Video units, including software that is running on the C20,
C40, C60, C90, E20, EX60, and EX90 codecs. The software version of
the Tandberg unit can be determined by logging into the web-based
user interface (UI) or using the "xStatus SystemUnit" command.

Users can determine the Tandberg software version by entering the IP
address of the codec in a web browser, authenticating (if the device
is configured for authentication), and then selecting the "system
info" menu option. The version number is displayed after the
"Software Version" label in the System Info box.

Alternatively the software version can be determined from the
device's application programmer interface using the "xStatus
SystemUnit" command. The software version running on the codec is
displayed after the "SystemUnit Software Version" label. The output
from "xStatus SystemUnit" will display a result similar to the
following:

    xStatus SystemUnit
    *s SystemUnit ProductType: "Cisco TelePresence Codec"
    *s SystemUnit ProductId: "Cisco TelePresence Codec C90"
    *s SystemUnit ProductPlatform: "C90"
    *s SystemUnit Uptime: 597095
    *s SystemUnit Software Application: "Endpoint"
    *s SystemUnit Software Version: "TC4.0"
    *s SystemUnit Software Name: "s52000"
    *s SystemUnit Software ReleaseDate: "2010-11-01"
    *s SystemUnit Software MaxVideoCalls: 3
    *s SystemUnit Software MaxAudioCalls: 4
    *s SystemUnit Software ReleaseKey: "true"
    *s SystemUnit Software OptionKeys NaturalPresenter: "true"
    *s SystemUnit Software OptionKeys MultiSite: "true"
    *s SystemUnit Software OptionKeys PremiumResolution: "true"
    *s SystemUnit Hardware Module SerialNumber: "B1AD25A00003"
    *s SystemUnit Hardware Module Identifier: "0"
    *s SystemUnit Hardware MainBoard SerialNumber: "PH0497201"
    *s SystemUnit Hardware MainBoard Identifier: "101401-3 [04]"
    *s SystemUnit Hardware VideoBoard SerialNumber: "PH0497874"
    *s SystemUnit Hardware VideoBoard Identifier: "101560-1 [02]"
    *s SystemUnit Hardware AudioBoard SerialNumber: "N/A"
    *s SystemUnit Hardware AudioBoard Identifier: ""
    *s SystemUnit Hardware BootSoftware: "U-Boot 2009.03-65"
    *s SystemUnit State System: Initialized
    *s SystemUnit State MaxNumberOfCalls: 3
    *s SystemUnit State MaxNumberOfActiveCalls: 3
    *s SystemUnit State NumberOfActiveCalls: 1
    *s SystemUnit State NumberOfSuspendedCalls: 0
    *s SystemUnit State NumberOfInProgressCalls: 0
    *s SystemUnit State Subsystem Application: Initialized
    *s SystemUnit ContactInfo: "helpdesk () company com"
    ** end

Products Confirmed Not Vulnerable
+--------------------------------

No other Cisco products are currently known to be affected by these
vulnerabilities.

Details
=======

Tandberg devices are part of the Cisco TelePresence Systems that
provide Cisco TelePresence endpoints for immersive environments,
conference rooms, individual desktops and home offices. The C Series
Endpoints are typically deployed as Multipurpose Room Systems and the
E/EX Personal Video units are desktop devices.

These devices contain a root user that is enabled for advanced
debugging that is unnecessary during normal operations. The root
account is not the same as the admin and user accounts. The root user
is enabled by default in software versions prior to TC 4.0.0. The
default configuration prior to TC 4.0.0 does not set a password for
the root user.

When a device is upgraded to TC 4.0.0, the root user is disabled.
System software for Tandberg C Series Endpoints and E/EX Personal
Video units is available for download at: 

http://www.tandberg.com/support/video-conferencing-software-download.jsp?t=2 

For instructions on how to set a root password or disable the root
user on other software versions, see the workaround section of this
advisory.

This vulnerability has been assigned the CVE ID CVE-2011-0354.

Vulnerability Scoring Details
=============================

Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding
CVSS at:

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html


Cisco has also provided a CVSS calculator to help compute th