-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Debian Allstar Linux Image (DIAL) vulnerability AllStarLink, Inc June 8, 2017 Summary A critical vulnerability has been found in DIAL permitting a remote attacker log into the node and gain local user shell. This vulnerability exists because the DIAL default install has a default user account with a static password. An attacker could exploit this vulnerability by connecting remotely to a node and logging in by using the credentials for this default user account. AllStarLink has released new x86 and arm install images which remove this default account by default. No privilege escalation has been found. Affected Releases DIAL x86 DIAL arm (Raspberry Pi) Workarounds Depending on release remove the following user accounts: pi - arm debian - x86 Example code to disable and remove accounts: x86: 'passwd -d debian' 'userdel -r debian' arm: 'passwd -d pi' 'userdel -r pi' Further an acl or firewall can be used to restrict remote ssh access to the node. Exploitation and Public Announcements A well known scanning tool has added "allstarlinux" to it's exploit scanning tools. Exploited systems have been found to engage in bitcoin mining, SIP termination or further scanning. If a node has been exploited AllStarLink recommends a re-imaging of the system. Fixed Releases Users should upgrade to the current RC1 release. arm - http://dvswitch.org/files/DIAL/amd64-i386-DIAL-RC1.tar.gz x86 - http://dvswitch.org/files/DIAL/RAT_RC1.tar.gz Further notes The older centos based ACID distribution has not been checked to determine if it's affected by this vulnerability. ACID has been depreciated and unsupported since 2015. All ACID users should migrate immediately to DIAL. The AllStarLink app_rpt mailing list provides a discussion forum and access to the admin and development teams. We encourage all users to join and participate. http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users Status of this Notice This notice provides information for the community. Distribution of this notice is unlimited. Copyright Copyright (C) AllStarLink, Inc (2017). All Rights Reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJZOZpwAAoJEGE5oGFSxpFAy8IP/37XXJYK/3RFjtm6tV1+HUYk haB3H3fMi0MpEH2j4q1OlWyo1QGJKXt73L01m8c2K/O5cT3TvFhc/VzSOugwB1R1 xVWAzm1gycBKzDRe535cdyih4NEVCzZixlH8crs2s1JxSq1xQKMojdc+g3v0ogGn 8PywTlUqAHMrCfmqmouZcVPferV4mNvlYkcglJm2ZYLnSnW3BEIEHrYqGfWReoXB rJ1hAtY7tJlqHaJ6woBcslkE0RljEB+VI0HK96FBUeGDJwW1w/Hy6pEN0SbOvOtY r19INGoEjgN55U1Mnkbnc8hH4HtycWDqVIUDfyBIlB+pqjOlj0Vmx0XUB6x0Fzkf rh6WzFLib8AAEZMjMyt439mWB2LLh/X+6mP+zmaYdJIZtOEXZZCj0QhOh6p36ZD9 rVBYB4OJnxQ5a7FvNr0k44GTc/VxmG8M8hNoXDD91HNJPOdQQUFTA5O9YcvR7z7x FZ5moFCYbIL/Iut5OIXv+ZTu18czb66etX4hkbp5wZkyJRNaWZZ29b94j68S8Pr/ r5qxlDHVSdV5i7VpU1tmc66E7XaqVX4A3bXdeVUSIGi6T7FI68w2ZMjJcor6ZhTg gjBncLFoBiEEETM4kDS+3ro3JT9R86s6BdnvoZ1PYrpoNW830pgXx6tj6VXOgvrS VTF5N7Y0nTFyp6nSF+5c =KD2I -----END PGP SIGNATURE-----