Security issue
https://www.cvedetails.com/cve/CVE-2019-15055/
Re: CVE-2019-15055
Already fixed in 6.45.5 and others. So what?
Re: CVE-2019-15055
Would be NICE IF it was mentioned in the following linkAlready fixed in 6.45.5 and others. So what?
https://blog.mikrotik.com/
Re: CVE-2019-15055
I will not be as polite. The worm should go back in its hole if its going to make posts with 0 value!
It seems mozerd that they are not updating the blog. Good pickup!
(of course this assumes that 15055 is actually covered).
It seems mozerd that they are not updating the blog. Good pickup!
(of course this assumes that 15055 is actually covered).
Re: CVE-2019-15055
Yes 15055 is mentioned in the logs ... MikroTik needs to be much more proactive in making sure that the blog site is uptodate especially where security issues are concerned.It seems mozerd that they are not updating the blog. Good pickup!
(of course this assumes that 15055 is actually covered).
Re: CVE-2019-15055
You must have full admin access to the system, and you must be already logged into the system. This is a low priority issue, as described in the CVEDETAILS site.
Re: CVE-2019-15055
Don't mean to ruffle your feathers my friend but....... many clients of MT providers/installers do have full admin access and login. I am a perfect example. I could be the moron giving up the farm, so it may be a low level of concern for enterprise and medium businesses but may be very germane to another segment of MT users and their providers/installers. Of course, my contract states, always disagree with angry red birds, SOB and mkx. 
Re: CVE-2019-15055
anav, if ability to remove firewall or reset system to defaults also a CVE candidate then?
Re: CVE-2019-15055
True enough, I am far more dangerous than the CVEanav, if ability to remove firewall or reset system to defaults also a CVE candidate then?
-
-
albinolobster
just joined
- Posts: 2
- Joined:
Re: CVE-2019-15055
It should be pointed out that this vulnerability is more severe than reseting passwords. An attacker can use this vulnerability to get a root shell on the router. Unfortunately, MITRE (the org that runs the CVE program) hasn't updated the description. Access to a root shell is pretty concerning. I wrote the details up here: https://medium.com/tenable-techblog/roo ... d7b8665f90
Note that this remains unfixed in Long-term.
Note that this remains unfixed in Long-term.
Re: CVE-2019-15055
SUPERB post and proof of concept by albinolobster ...... thank you.It should be pointed out that this vulnerability is more severe than reseting passwords. An attacker can use this vulnerability to get a root shell on the router. Unfortunately, MITRE (the org that runs the CVE program) hasn't updated the description. Access to a root shell is pretty concerning. I wrote the details up here: https://medium.com/tenable-techblog/roo ... d7b8665f90
Note that this remains unfixed in Long-term.
Re: CVE-2019-15055
If you have physical access and admin account, you can already get full access and shell and it's by design. I still don't understand how ANOTHER way to do the same thing is considered a CVE.
-
-
albinolobster
just joined
- Posts: 2
- Joined:
Re: CVE-2019-15055
I'm actually unfamiliar with how an admin is able to access the busybox root shell? There is no feature that I know of that allows for that, at least that I'm aware of.If you have physical access and admin account, you can already get full access and shell and it's by design.
As you know, a vulnerability is just a crossing of security boundaries. CVE-2019-15055 allows someone to elevate from an admin account to root shell. That seems like a security boundary to me.
Re: CVE-2019-15055
You're not alone. The feature exists, but as far as I know, it's not for public use.
Re: CVE-2019-15055
Hey Sob, so what your saying is this is a backdoor for MT support, so as to be able to team viewer into your router, when asked of course, to fix something on the router which requires root access instead of sending the router back to MT or buying another one? I wonder if this only available for those that pay for support directly?? aka a FEATURE LOL.You're not alone. The feature exists, but as far as I know, it's not for public use.
Re: CVE-2019-15055
There is a special .npk package you can install that allows you to SSH into a root shell. You can also mount the filesystem offline or use this CVE to do a similar thing, if you have physical access to the router then nothing is really secure.
Re: CVE-2019-15055
The POINT you make is exactly correct.As you know, a vulnerability is just a crossing of security boundaries. CVE-2019-15055 allows someone to elevate from an admin account to root shell. That seems like a security boundary to me.
ROOT SHELL is not permitted under RouterOS because it’s proprietary... Closed source ..... locked to its users. Providing the ability to gain root shell is the primary issue because of all that it exposes and enables.
Other os’s like UBNT EdgeMax allow root access because it’s open source and it’s up to the knowledgeable user to control it.