Feeds

Red Hat Piranha ‘backdoor’ password discovered

Enables total control of a server

  • alert
  • submit to reddit

Maximizing your infrastructure through virtualization

An undocumented backdoor password in the Red Hat Linux Piranha package containing Linux Virtual Server (LVS) software has been discovered by Allen Wilson of the X-Force department of security outfit Internet Security Systems. The backdoor password allows remote attackers to execute commands on a server, ISS says. If an affected version of Piranha is installed and the default backdoor password remains unchanged, any remote or local user may log in to the LVS Web interface. From there, LVS parameters can be changed and arbitrary commands can be executed with the same privilege as that of the Web server. The vulnerability is present even if the LVS service is not used, ISS warns. If the affected package is installed and the password has not been changed by the administrator from the pre-set login/pass combination "piranha" and "Q", the system is vulnerable. The current distribution of Red Hat Linux 6.2 is vulnerable. Earlier versions are not. Red Hat has provided an updated Piranha package, version 0.4.13-1, available here. Meanwhile, all the gruesome technical details of the ISS advisory are posted here. ®

The Power of One Infographic

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Airbus promises Wi-Fi – yay – and 3D movies (meh) in new A330
If the person in front reclines their seat, this could get interesting
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
Samsung threatens to cut ties with supplier over child labour allegations
Vows to uphold 'zero tolerance' policy on underage workers
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.