Date: Thu, 28 Mar 2024 10:38:31 -0400 (EDT) Message-ID: <188706377.487.1711636711436@windcrest.sei.cmu.edu> Subject: Exported From Confluence MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_Part_486_1025669175.1711636711434" ------=_Part_486_1025669175.1711636711434 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Location: file:///C:/exported.html
A complete revision history is at the end of this file.
A vulnerability has been discovered in the default configuration of Coba= lt Networks RaQ2 servers that allows remote users to install arbitrary soft= ware packages to the system. RaQ2 servers are configured with an administra= tive webserver to process remote requests to manage the unit. Systems insta= lled with the default configuration have insufficient access control mechan= isms to prevent remote users from adding arbitrary software packages to the= system using this webserver.
A document published by Cobalt Networks describes the vulnerability and = solutions in more detail:
Any remote user who can establish a connection to an administrative port= on a vulnerable RaQ2 server can install arbitrary software packages on the= server. This access can then be used to gain root privileges on the system= .
Configure your Systems to Guard Against this Vulnerability
Install the patches provided by Cobalt Networks:
The CERT/CC wishes to thank Cobalt Networks for their assistance in deve= loping this advisory.
Copyright 1999 Carnegie Mellon University.
Jul 30, 1999:=09Initial release Aug 8, 1999:=09Updated link to Cobalt Networks announcement Jul 25, 2001:=09Fixed typo in title