<div dir="ltr">This seems to be one of the trailer machines, but .109 is not in the list that I collected. <div><br></div><div><a href="https://docs.google.com/spreadsheet/ccc?key=0AmkIbfHWlKK7dDRObWxtdFlHZU1hY3BJN0NNM0xMRkE&usp=sharing">https://docs.google.com/spreadsheet/ccc?key=0AmkIbfHWlKK7dDRObWxtdFlHZU1hY3BJN0NNM0xMRkE&usp=sharing</a></div>
<div><br></div><div style>Is anyone using the machine under the center desk at the back wall of the trailer (Ai's old desk)? This machine is currently turned on and might be the problem. If nobody gets back to me I am going to turn it off. </div>
<div>
<br></div><div>Thanks,</div><div><div style>-John</div><div>
<br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 20 June 2013 09:05, Matthew Turk <span dir="ltr"><<a href="mailto:mturk@cs.ucsb.edu" target="_blank">mturk@cs.ucsb.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">We've been notified that there's a vulnerability in a lab machine, IP<br>
address 128.111.28.109. Please check to see if this is your machine. The<br>
problem is with Dropbear SSH, which needs to be upgraded to version 2012.55<br>
or later.<br>
<br>
And please let me know if this is your machine, so I'll know it's being<br>
fixed.<br>
<br>
Thanks,<br>
Matthew<br>
<br>
-----Original Message-----<br>
From: Todd Atkins via RT [mailto:<a href="mailto:vsc@oit.ucsb.edu">vsc@oit.ucsb.edu</a>]<br>
Sent: Wednesday, June 19, 2013 4:07 PM<br>
To: <a href="mailto:support@cs.ucsb.edu">support@cs.ucsb.edu</a><br>
Subject: [UCSB-OIT #506586] Vulnerabilities Found on 128.111.28.109<br>
<br>
Greetings:<br>
<br>
Our vulnerability scanner has found a potentially vulnerable host on your<br>
network. You should consider taking the recommended actions mentioned in<br>
this report in order to reduce the chances of this host being abused by an<br>
attacker. If you believe any part of this report to be incorrect, please<br>
let us know so that we can work to improve our reporting accuracy.<br>
<br>
Here is information about the vulnerabilities that were found:<br>
<br>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++<br>
<br>
IP : 128.111.28.109<br>
Name : <a href="http://ilab-109.cs.ucsb.edu" target="_blank">ilab-109.cs.ucsb.edu</a><br>
Scan Time : Tue Jun 18 20:32:53 2013<br>
Service : ssh (22/tcp)<br>
Plugin ID : 58183<br>
Synopsis :<br>
<br>
The remote host is affected by a remote code execution vulnerability.<br>
<br>
Description :<br>
<br>
According to its self-reported banner, the remote host is running a version<br>
of Dropbear SSH before 2012.55. As such, it reportedly contains a flaw that<br>
might allow an attacker to run arbitrary code on the remote host with root<br>
privileges if they are authenticated using a public key and command<br>
restriction is enforced.<br>
<br>
Note that Nessus has not tried to exploit this vulnerability but instead has<br>
relied solely on the version in the service's banner.<br>
<br>
Note also, in cases where the host is running ESXi 4.0 or ESXi 4.1, VMware<br>
states in their KB article id 2037316 that this is a false positive since<br>
administrative access is required to login via SSH so there are no<br>
privileges to be gained by exploiting this issue. That is true only in a<br>
default setup, not one in which SSH access has been enabled for non-root<br>
users.<br>
<br>
See also :<br>
<br>
<a href="https://matt.ucc.asn.au/dropbear/CHANGES" target="_blank">https://matt.ucc.asn.au/dropbear/CHANGES</a><br>
<a href="https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749" target="_blank">https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749</a><br>
<a href="https://www.mantor.org/~northox/misc/CVE-2012-0920.html" target="_blank">https://www.mantor.org/~northox/misc/CVE-2012-0920.html</a><br>
<a href="http://kb.vmware.com/kb/2037316" target="_blank">http://kb.vmware.com/kb/2037316</a><br>
<br>
Solution :<br>
<br>
Upgrade to the Dropbear SSH 2012.55 or later.<br>
<br>
CVSS Base Score : 8.5<br>
(CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C)<br>
CVSS Temporal Score : 6.3<br>
(CVSS2#E:U/RL:OF/RC:C)<br>
Public Exploit Available : false<br>
<br>
Plugin output :<br>
<br>
Version source : SSH-2.0-dropbear_0.52<br>
Installed version : 0.52<br>
Fixed version : 2012.55<br>
<br>
CVE : CVE-2012-0920<br>
BID : 52159<br>
Other references : OSVDB:79590<br>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++<br>
<br>
<br>
--<br>
E. Todd Atkins<br>
Office of Information Technology<br>
University of California, Santa Barbara<br>
<br>
**********************************************************************<br>
The NOC's list of network contacts is used to determine who should receive<br>
email such as this. Please direct any requests for changes to this list of<br>
network contacts to <a href="mailto:noc@ucsb.edu">noc@ucsb.edu</a>.<br>
**********************************************************************<br>
<br>
<br>
<br>
_______________________________________________<br>
Ilab-users mailing list<br>
<a href="mailto:Ilab-users@lists.cs.ucsb.edu">Ilab-users@lists.cs.ucsb.edu</a><br>
<a href="https://lists.cs.ucsb.edu/mailman/listinfo/ilab-users" target="_blank">https://lists.cs.ucsb.edu/mailman/listinfo/ilab-users</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>John O'Donovan<br>Research Scientist<br>Department of Computer Science<br>University of California, Santa Barbara, CA 93106-5110<br><br>email: <a href="mailto:jod@cs.ucsb.edu" target="_blank">jod@cs.ucsb.edu</a><br>
phone: (805)451-9342<div>web: <a href="http://cs.ucsb.edu/~jod" target="_blank">http://cs.ucsb.edu/~jod</a></div>
</div>