bugtraq - Re: Fw: APC 9606 SmartSlot Web/SNMP management card "backdoor"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200402172256.58290.james@stealthnet.co.uk>
Date: Tue, 17 Feb 2004 22:56:58 +0000
From: James Green <james@...althnet.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: Fw: APC 9606 SmartSlot Web/SNMP management card "backdoor" - MORE PROBLEMS

On Tuesday 17 Feb 2004 6:23 pm, thiago.vazquez@...ht.com.br wrote:
> We have many products from APC and we've tested that vulnerability in some
> of them and ..... following are the results.

[ snip ]

According to a Matias Kvaternik at APC (US) today, the bug was discovered 
after the AP9606 was discontinued (we bought some less than one year ago), 
and the engineering team has "no fix in the pipeline". He advises us to 
switch off telnet access.

I would imagine most APC products are installed to last for a good three to 
six years - upgrading power hardware is probably about as practical as 
upgrading a load of networking equipment. I'm surprised, indeed disappointed, 
that APC doesn't appear to provide critical security fixes for these 
discontinued products; although I do only speak from very limited experience 
of APC.

James Green