Don

ACME - Waterworks External Penetration Test June 24th, 2021

External/Internal Penetration Test

06/10/2020

Contents Introduction/Objective ................................................................................................... 2 Methodology: Common Vulnerability Scoring System..................................................... 2 Executive Summary of Findings....................................................................................... 3 Notes on Remediation .................................................................................................... 4 Technical Report by Severity ........................................................................................... 5 Appendix A: Issue/Vulnerability Name – Count of Each ................................................ 15 Plans of Action and Milestones ..................................................................................... 19

Penetration Testing

ACME Waterworks

1

External/Internal Penetration Test

06/10/2020

Introduction/Objective RCS Secure performed an Internal and External Penetration Test for ACME Waterworks between May 10, 2021, through May 14, 2021. The penetration and vulnerability assessment testing was performed on multiple hosts and locations as requested – Head Quarters is located in Niagara Falls, New York. The objective of this testing was to evaluate the current security posture of the organization’s external network and the specified web applications.

For purposes of the vulnerability testing, we were provided a list of systems to be included in the scope. During the vulnerability assessment portion, we did identify a number of vulnerabilities that we recommend be remediated to ensure these external systems are secure.

Methodology: Common Vulnerability Scoring System The Common Vulnerability Scoring System (CVSS) captures the principal technical characteristics of software, hardware, and firmware vulnerabilities. Its outputs include numerical scores indicating the severity of a vulnerability relative to other vulnerabilities.

Base Scores are usually produced by the organization maintaining the vulnerable product, or a third-party scoring on their behalf. It is typical for only the Base Metrics to be published as these do not change over time and are common to all environments.

CVSS Severity

CVSS Score

Critical

9.0-10

High

7.0-8.9

Medium

4.0-6.9

Low

0.1-3.9

Informational

0

Penetration Testing

Description Exploitation would fundamentally undermine the security of affected devices and networks, enable actors to perform significant attacks with minimal effort, impact a wide number of systems.

Exploitation would enable attacker to have a notable direct impact to the security of targeted devices and networks without needing to overcome any major mitigating factors.

Exploitation would enable attackers to perform activities on the targeted device or network but would require additional steps Exploitation would have little to no security impact on targeted system No known exploitation activity, underground discussions, proof of concept or exploit code, but has a low potential for exploitation

ACME Waterworks

2

External/Internal Penetration Test

06/10/2020

Executive Summary of Findings During the assessment, we identified 62 Critical and 177 High-risk Vulnerabilities. It is possible for some vulnerabilities to be recognized on one IP address, multiple times, although via different ports. Some key findings are outlined below Items with a score of 9-10 (critical) • Create a remediation plan within two weeks • Remediate within a month Items with a score of 7-8.9 (high-risk) • Create a remediation plan within a month • Remediate within three months

VMware ESXi Input Validation Vulnerability CVSS Score 10 The scan detected an input validation vulnerability in the VMware vCenter server 5.0/5.5 (server management software). This affects the functionality component of the heartbeat message handler. Manipulation of an input leads to a privilege escalation vulnerability. An unauthenticated remote attacker can, via an MLet file, execute arbitrary code in the vCenter server with the same privileges as the web server Upgrade to VMware vCenter server 6.0.0b (6.0.0 build-2776510), 5.5u3(5.5.0 build – 3000241), 5.1u3b(5.1.0 build-3070521), or 5.0u3e(5.0.0- build-3073234) or later to resolve this issue.

HP iLO Privilege Escalation Vulnerability CVSS Score - 10 We identified an issue in the Treck TCP-IP Stack. The issue impacts an unknown functionality of the component of IPv4 Tunneling. Manipulating this functionality can lead to a privilege escalation vulnerability.

This vulnerability can be uniquely defined as CVE-2020-11896. The attack may be launched remotely. No form of authentication is required for exploitation.

Upgrading to Treck TCP/IP stack 6.0.1.66 eliminates this vulnerability. Also, upgrade HP iLO 3 firmware version 1.93 or later, iLO 4 firmware version 2.75 or later, iLO 4 for superdome, HP Integrated Lights-Out 4 (iLO 4) firmware version 2.53, or firmware of HP Integrate LightsOut 4 (iLO 4) to 2.53 or later.

NFS Exported Share Information Disclosure CVSS Score - 10 ACME Waterworks systems were found to be vulnerable to the NFS Exported Share Information disclosure. At least one of NFS shares exported by the remote server could be mounted by the scanning host. An attacker could use this to read or write files onto a remote host.

Penetration Testing

ACME Waterworks

3

External/Internal Penetration Test

06/10/2020

This vulnerability can be uniquely identified as CVE-1999-0211. The exploitability is said to be easy. An attack could be initiated remotely without any form of authentication. The technical details are unknown, and an exploit is not available Configure NFS on the remote host so that only authorized hosts can mount its remote shares.

Unsupported Windows OS (remote) CVSS Score - 9.8 The scan revealed the ACME Waterworks systems were vulnerable to Unsupported Windows OS. The remote version of Microsoft windows is either missing a service pack or is no longer supported. This can cause a variety of vulnerabilities.

Upgrade to a supported service pack or operating system in order to resolve this vulnerability.

Notes on Remediation The issues identified in this audit require timely remediation. Many of the items discovered can be easily corrected. Other issues will require careful study to ensure that implementing a specific control does not have a negative impact on normal business operations. A follow-up test should be performed in the next 9 to 12 months to independently verify that the required controls are in place. The Technical Report enclosed is intended for the technical audit and security staff who will be working to address and resolve the control issues. It outlines the items that need to be corrected and the priority of the issue.

Appendices are also included to provide examples of and additional information about the control issues.

Penetration Testing

ACME Waterworks

4

External/Internal Penetration Test

06/10/2020

Technical Report by Severity – 794 Individual Hosts

Host(IP)/Name(of risk)/ Solution Critical 172.16.12.31 HP iLO 3 < 1.93 / HP iLO 4 < 2.75 / HP iLO Superdome 4 < 1.64 / HP iLO 5 < 2.18 / HP Moonshot/Edgeline iLO 5 < 2.30 Ripple20 Multiple vulnerabilities Upgrade to HP iLO 3 firmware version 1.93 or later, iLO 4 firmware version 2.75 or later, or iLO 4 for Superdome version 1.64 or later, or HP iLO 5 firmware version 2.18 or HP Moonshot/Edgeline iLO 5 to version 2.30 or later. iLO 4 < 2.60 / iLO 5 < 1.30 Multiple Vulnerabilities For HP Integrated Lights-Out (iLO) 4 upgrade firmware to 2.60 or later.

For iLO 5, upgrade firmware to 1.30 or later.

HP iLO 4 <= 2.52 RCE Upgrade to HP Integrated Lights-Out 4 (iLO 4) firmware version 2.53. iLO 4 < 2.53 Remote Code Execution Vulnerability Upgrade firmware of HP Integrated Lights-Out 4 (iLO 4) to 2.53, or later. iLO 3 < 1.90 / iLO 4 < 2.61 / iLO 5 < 1.35 Remote Code Execution Vulnerability (HPESBHF03866) Upgrade firmware of For iLO 3, upgrade firmware to 1.90 or later.

For iLO 4, upgrade firmware to 2.61 or later. For iLO 5, upgrade firmware to 1.35 or later.

Alternatively, apply the workarounds outlined in the vendor advisory.

172.17.0.34 HP iLO 3 < 1.93 / HP iLO 4 < 2.75 / HP iLO Superdome 4 < 1.64 / HP iLO 5 < 2.18 / HP Moonshot/Edgeline iLO 5 < 2.30 Ripple20 Multiple vulnerabilities Upgrade to HP iLO 3 firmware version 1.93 or later, iLO 4 firmware version 2.75 or later, or iLO 4 for Superdome version 1.64 or later, or HP iLO 5 firmware version 2.18 or HP Moonshot/Edgeline iLO 5 to version 2.30 or later.

172.16.12.32 VMware ESXi 5.5 < Build 3029944 OpenSLP RCE (VMSA-2015-0007) Apply patch ESXi550-201509101-SG for ESXi 5.5.

Unix Operating System Unsupported Version Detection Upgrade to a version of the Unix operating system that is currently supported.

172.16.75.225 NFS Exported Share Information Disclosure

Penetration Testing

ACME Waterworks

5

External/Internal Penetration Test

06/10/2020

Configure NFS on the remote host so that only authorized hosts can mount its remote shares.

172.16.75.224 NFS Exported Share Information Disclosure Configure NFS on the remote host so that only authorized hosts can mount its remote shares.

172.16.75.204 Microsoft SQL Server Unsupported Version Detection (remote check) Upgrade to a version of Microsoft SQL Server that is currently supported.

Unsupported Windows OS (remote) Upgrade to a supported service pack or operating system 172.16.32.14 Dell iDRAC Buffer Overflow Vulnerability (CVE-2020-5344) Update the remote host to iDRAC7 firmware 2.65.65.65 or iDRAC8 firmware 2.70.70.70, or iDRAC9 firmware 4.00.00.00, or higher.

172.16.75.229 Unsupported Windows OS (remote) Upgrade to a supported service pack or operating system 172.16.75.228 Unsupported Windows OS (remote) Upgrade to a supported service pack or operating system 172.16.25.8 Unprotected Telnet Service Configure an authentication mechanism or restrict access to the service.

172.16.75.230 Unsupported Windows OS (remote) Upgrade to a supported service pack or operating system 172.16.26.13 Dell iDRAC Buffer Overflow Vulnerability (CVE-2020-5344) Update the remote host to iDRAC7 firmware 2.65.65.65 or iDRAC8 firmware 2.70.70.70, or iDRAC9 firmware 4.00.00.00, or higher.

172.16.25.5 Samba smbd Security Descriptor Parsing Remote Overflow Upgrade to Samba 3.0.10 or later.

172.16.75.227 Unsupported Windows OS (remote) Upgrade to a supported service pack or operating system

High 172.16.75.225

Penetration Testing

ACME Waterworks

6

External/Internal Penetration Test

06/10/2020

Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.100, 8.5.51, 9.0.31 or later.

Apache Tomcat 7.0.41 < 7.0.90 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.90 or later.

172.16.75.224 Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.100, 8.5.51, 9.0.31 or later.

Apache Tomcat 7.0.41 < 7.0.90 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.90 or later.

172.16.75.229 Apache Tomcat 7.0.x < 7.0.57 Multiple Vulnerabilities (POODLE) Update to Apache Tomcat version 7.0.57 or later.

Unsupported Web Server Detection Remove the web server if it is no longer needed. Otherwise, upgrade to a supported version if possible or switch to another server.

172.16.75.228 Apache Tomcat 7.0.x < 7.0.57 Multiple Vulnerabilities (POODLE) Update to Apache Tomcat version 7.0.57 or later.

Unsupported Web Server Detection Remove the web server if it is no longer needed. Otherwise, upgrade to a supported version if possible or switch to another server.

172.16.75.230 Apache Tomcat 7.0.x < 7.0.57 Multiple Vulnerabilities (POODLE) Update to Apache Tomcat version 7.0.57 or later.

Unsupported Web Server Detection Remove the web server if it is no longer needed. Otherwise, upgrade to a supported version if possible or switch to another server.

172.16.75.227 Apache Tomcat 7.0.x < 7.0.57 Multiple Vulnerabilities (POODLE) Update to Apache Tomcat version 7.0.57 or later.

Unsupported Web Server Detection Remove the web server if it is no longer needed. Otherwise, upgrade to a supported version if possible or switch to another server.

172.16.75.126 Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.100, 8.5.51, 9.0.31 or later.

Apache Tomcat 7.0.41 < 7.0.90 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.90 or later.

172.16.12.31 iLO 4 < 2.70 / iLO 5 < 1.40a Multiple Vulnerabilities

Penetration Testing

ACME Waterworks

7

External/Internal Penetration Test

06/10/2020

For HP Integrated Lights-Out 4 (iLO 4) upgrade firmware to version 2.70 or later. For HP Integrated Lights-Out 5 (iLO 5) upgrade firmware to version 1.40a or later.

IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.16.75.238 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.75.125 Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.100, 8.5.51, 9.0.31 or later.

Apache Tomcat 7.0.41 < 7.0.90 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.90 or later.

172.16.75.105 Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities Upgrade to Apache Tomcat version 7.0.100, 8.5.51, 9.0.31 or later.

Apache Tomcat AJP Connector Request Injection (Ghostcat) Update the AJP configuration to require authorization and/or upgrade the Tomcat server to 7.0.100, 8.5.51, 9.0.31 or later.

172.16.75.222 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.12.32 ESXi 5.5 < Build 5230635 Multiple Vulnerabilities (VMSA-2017-0006) (remote check) Apply patch ESXi550-201703401-SG according to the vendor advisory.

SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.75.106 Flexera FlexNet Publisher < 11.16.2 Multiple Vulnerabilities Upgrade to FlexNet Publisher 11.16.2 or later.

172.16.12.2

Penetration Testing

ACME Waterworks

8

External/Internal Penetration Test

06/10/2020

SSH Protocol Version 1 Session Key Retrieval Disable compatibility with version 1 of the SSH protocol.

172.17.4.50 Microsoft Windows SMB Shares Unprivileged Access To restrict access under Windows, open Explorer, do a right click on each share, go to the 'sharing' tab, and click on 'permissions'.

SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.16.14.5 Cisco AireOS Software for Cisco Wireless LAN Controllers (WLC) DoS (cisco-sa-iosxe-wlc-fnfv9EvrAQpNX) Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvr53845 Cisco Wireless LAN Controller Secure Shell (SSH) Denial of Service Vulnerability (cisco-sa20191016-wlc-ssh-dos) Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvp34148 172.17.0.21 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.16.75.75 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.75.140 ESXi 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2020-0026) Apply the appropriate patch as referenced in the vendor advisory.

172.16.12.4

Penetration Testing

ACME Waterworks

9

External/Internal Penetration Test

06/10/2020

Cisco AireOS Software for Cisco Wireless LAN Controllers (WLC) DoS (cisco-sa-iosxe-wlc-fnfv9EvrAQpNX) Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvr53845 Cisco Wireless LAN Controller Secure Shell (SSH) Denial of Service Vulnerability (cisco-sa20191016-wlc-ssh-dos) Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvp34148 10.16.12.4 Cisco AireOS Software for Cisco Wireless LAN Controllers (WLC) DoS (cisco-sa-iosxe-wlc-fnfv9EvrAQpNX) Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvr53845 Cisco Wireless LAN Controller Secure Shell (SSH) Denial of Service Vulnerability (cisco-sa20191016-wlc-ssh-dos) Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvp34148 172.16.25.5 Samba Multiple Remote Vulnerabilities Upgrade to Samba 3.0.8 or later.

172.17.0.26 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.17.40.17 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.17.0.30 SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.16.12.20 SNMP Agent Default Community Name (public)

Penetration Testing

ACME Waterworks

10

External/Internal Penetration Test

06/10/2020

Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.17.0.24 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.16.29.14 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.17.0.28 SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.16.75.114 Apache Solr 5.x < 5.5.5 / 6.x < 6.6.2 / 7.x < 7.1.0 Multiple Vulnerabilities Upgrade to Apache Solr version 5.5.5 / 6.6.2 / 7.1.0 or later.

172.16.75.189 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.138.2 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.75.204

Penetration Testing

ACME Waterworks

11

External/Internal Penetration Test

06/10/2020

SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.12.21 SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.17.0.25 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.17.40.20 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.17.0.27 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.16.28.23 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of

Penetration Testing

ACME Waterworks

12

External/Internal Penetration Test

06/10/2020

off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.17.0.29 SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.16.26.2 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.17.0.34 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.16.30.15 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.17.40.16 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.16.32.14 SNMP Agent Default Community Name (public)

Penetration Testing

ACME Waterworks

13

External/Internal Penetration Test

06/10/2020

Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

172.17.40.18 SSL Version 2 and 3 Protocol Detection Consult the application's documentation to disable SSL 2.0 and 3.0.

Use TLS 1.2 (with approved cipher suites) or higher instead.

172.17.0.22 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.17.0.23 IPMI v2.0 Password Hash Disclosure There is no patch for this vulnerability; it is an inherent problem with the specification for IPMI v2.0. Suggested mitigations include : - Disabling IPMI over LAN if it is not needed.

- Using strong passwords to limit the successfulness of off-line dictionary attacks.

- Using Access Control Lists (ACLs) or isolated networks to limit access to your IPMI management interfaces.

172.16.26.13 SNMP Agent Default Community Name (public) Disable the SNMP service on the remote host if you do not use it.

Either filter incoming UDP packets going to this port, or change the default community string.

Penetration Testing

ACME Waterworks

14

External/Internal Penetration Test

06/10/2020

Appendix A: Issue/Vulnerability Name – Count of Each

Name of Issue / CVSS Score 10 NFS Exported Share Information Disclosure Unsupported Windows OS (remote) VMware ESXi 5.5 < Build 3029944 OpenSLP RCE (VMSA-2015-0007) HP iLO 4 <= 2.52 RCE iLO 4 < 2.53 Remote Code Execution Vulnerability Dell iDRAC Buffer Overflow Vulnerability (CVE-2020-5344) Unix Operating System Unsupported Version Detection Microsoft SQL Server Unsupported Version Detection (remote check) Unprotected Telnet Service Samba smbd Security Descriptor Parsing Remote Overflow 9.3 HP iLO 3 < 1.93 / HP iLO 4 < 2.75 / HP iLO Superdome 4 < 1.64 / HP iLO 5 < 2.18 / HP Moonshot/Edgeline iLO 5 < 2.30 Ripple20 Multiple vulnerabilities 9 iLO 4 < 2.60 / iLO 5 < 1.30 Multiple Vulnerabilities iLO 3 < 1.90 / iLO 4 < 2.61 / iLO 5 < 1.35 Remote Code Execution Vulnerability (HPESBHF03866) 8.3 iLO 4 < 2.70 / iLO 5 < 1.40a Multiple Vulnerabilities 7.8 IPMI v2.0 Password Hash Disclosure Cisco AireOS Software for Cisco Wireless LAN Controllers (WLC) DoS (cisco-sa-iosxe-wlcfnfv9-EvrAQpNX) Cisco Wireless LAN Controller Secure Shell (SSH) Denial of Service Vulnerability (ciscosa-20191016-wlc-ssh-dos) 7.5 Apache Tomcat 7.0.x < 7.0.57 Multiple Vulnerabilities (POODLE) Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities Apache Tomcat 7.0.41 < 7.0.90 Multiple Vulnerabilities SNMP Agent Default Community Name (public) Unsupported Web Server Detection Flexera FlexNet Publisher < 11.16.2 Multiple Vulnerabilities SSH Protocol Version 1 Session Key Retrieval Microsoft Windows SMB Shares Unprivileged Access Samba Multiple Remote Vulnerabilities Apache Tomcat AJP Connector Request Injection (Ghostcat)

Penetration Testing

ACME Waterworks

Count of Each 24 6 5 3 2 2 2 1 1 1 1 32 32 6 4 2 6 6 18 12 3 3 127 52 30 18 9 4 4 3 2 2 2

15

External/Internal Penetration Test

06/10/2020

Apache Solr 5.x < 5.5.5 / 6.x < 6.6.2 / 7.x < 7.1.0 Multiple Vulnerabilities 7.2 ESXi 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2020-0026) ESXi 5.5 < Build 5230635 Multiple Vulnerabilities (VMSA-2017-0006) (remote check) 7.1 SSL Version 2 and 3 Protocol Detection 6.8 Apache Tomcat 7.0.x < 7.0.60 Multiple Vulnerabilities (FREAK) OpenSSL 'ChangeCipherSpec' MiTM Vulnerability Cisco Wireless LAN Controller Locally Significant Certificate Denial of Service Vulnerability Cisco Wireless LAN Controller Software GUI Configuration Denial of Service Vulnerabilities ESXi 5.5 < Build 3568722 / 6.0 < Build 3568940 glibc DNS Resolver RCE (VMSA-20160002) (remote check) 6.5 Dell iDRAC Products Multiple Vulnerabilities (December 2018) ESXi 5.5 < Build 3248547 Shared Folders (HGFS) Guest Privilege Escalation (VMSA-20160001) (remote check) 6.4 SSL Certificate Cannot Be Trusted SSL Self-Signed Certificate 6.1 TLS Version 1.0 Protocol Detection Cisco Wireless LAN Controller Software IAPP Message Handling Denial of Service Vulnerabilities 6 ESXi 5.5 / 6.0 / 6.5 / Multiple Vulnerabilities (VMSA-2017-0021) (VMSA-2018-0002) (Spectre) (remote check) Apache Solr < 6.6.1 Kerberos Plugin Delegation Token Handling Remote Information Disclosure Apache Solr < 8.4.0 Remote Code Execution 5.8 HSTS Missing From HTTPS Server (RFC 6797) Unencrypted Telnet Server 5.1 Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness Apache Tomcat 8.5.0 < 8.5.50 Privilege Escalation Vulnerability 5 SSL Medium Strength Cipher Suites Supported (SWEET32) SMB Signing not required SSL Certificate Expiry SSL Certificate Signed Using Weak Hashing Algorithm SSL Certificate with Wrong Hostname

Penetration Testing

ACME Waterworks

1 4 2 2 22 22 91 56 28 3 3 1 5 4 1 738 434 304 233 224 9 6 4 1 1 10 7 3 10 9 1 401 137 93 34 30 14

16

External/Internal Penetration Test

06/10/2020

Apache Tomcat Default Files mDNS Detection (Remote Network) Network Time Protocol (NTP) Mode 6 Scanner Apache Tomcat 7.0.x < 7.0.105 WebSocket DoS Apache Tomcat 7.0.x < 7.0.88 Denial of Service HTTP TRACE / TRACK Methods Allowed SAP BusinessObjects Business Intelligence Platform SSRF Vulnerability (direct check) Cisco Wireless LAN Controller CAPWAP DoS (cisco-sa-wlc-capwap-dos-Y2sD9uEw) Apache Tomcat 8.5.x < 8.5.60 Information Disclosure Flexera FlexNet Publisher lmadmin < 11.16.5.1 Multiple Vulnerabilities Elasticsearch Unrestricted Access Information Disclosure Apache Tomcat 8.5.0 < 8.5.57 Multiple Vulnerabilities Apache Tomcat 8.5.0 < 8.5.41 DoS Apache Tomcat 8.5.0 < 8.5.63 Multiple Vulnerabilities NFS Shares World Readable Samba < 3.0.7 Multiple Remote DoS DNS Server Zone Transfer Information Disclosure (AXFR) Samba smbd FindNextPrintChangeNotify() Request Remote DoS Apache Tomcat 8.5.0 < 8.5.56 DoS SNMP 'GETBULK' Reflection DDoS ESXi 6.5 / 6.7 / 7.0 DoS (VMSA-2020-0018) Samba Mangling Method Hash Overflow 4.7 ESXi 5.5 / 6.0 / 6.5 / 6.7 Speculative Execution Side Channel Vulnerability (Foreshadow) (VMSA-2018-0020) (remote check) 4.4 Apache Tomcat 7.0.0 < 7.0.104 Remote Code Execution Apache Tomcat 7.0.0 < 7.0.108 RCE ESXi 5.0 / 5.1 / 5.5 / 6.0 Multiple Vulnerabilities (VMSA-2016-0010) (remote check) Apache Tomcat 8.5.x < 8.5.55 Remote Code Execution Apache Tomcat 8.5.0 < 8.5.49 Privilege Escalation 4.3 JQuery 1.2 < 3.5.0 Multiple XSS SSL RC4 Cipher Suites Supported (Bar Mitzvah) SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE) Terminal Services Doesn't Use Network Level Authentication (NLA) Only SSL Weak Cipher Suites Supported SSH Weak Algorithms Supported Apache Tomcat 7.0.0 < 7.0.91 Open Redirect Weakness Terminal Services Encryption Level is Medium or Low Apache Tomcat 7.0.0 < 7.0.107 Information Disclosure iLO 3 < 1.88 / iLO 4 < 2.44 XSS Vulnerability SSL/TLS EXPORT_RSA <= 512-bit Cipher Suites Supported (FREAK)

Penetration Testing

ACME Waterworks

14 13 10 9 9 9 4 3 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 22 9 9 2 1 1 467 204 180 20 14 10 9 9 9 9 2 1

17

External/Internal Penetration Test 4 Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability iLO 3 < 1.85 / iLO 4 < 2.22 Denial of Service Vulnerability SSL Certificate Chain Contains Weak RSA Keys Dell iDRAC Improper Authorization (DSA-2019-137) VMware ESXi 5.5 / 6.0 / 6.5 / 6.7 DoS (VMSA-2018-0018) (remote check) Apache Tomcat 8.5.x < 8.5.58 / 9.0.x < 9.0.38 HTTP/2 Request Mix-Up 3.3 Cisco Wireless LAN Controller Secure Shell Unauthorized Access Vulnerability 2.6 SSH Server CBC Mode Ciphers Enabled SSH Weak MAC Algorithms Enabled Terminal Services Encryption Level is not FIPS-140 Compliant SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam) Transport Layer Security (TLS) Protocol CRIME Vulnerability 2.1 Cisco Wireless LAN Controller Path Traversal Vulnerability ESXi 5.5 < Build 6480267 RPC NULL Pointer Dereference Vulnerability (VMSA-20170015) (remote check)

Penetration Testing

ACME Waterworks

06/10/2020 11 3 2 2 2 1 1 3 3 189 144 28 9 6 2 4 3 1

18

Plans of Action and Milestones

ID

Identified Vulnerability

001

Vulnerability Management

002

Migration of end-of-life OS and applications are vulnerable

003

Deprecated TLS and SSL versions

004

Deprecated TLS versions

Remediation Steps or Justification for Accepting

Assignee

Anticipated Implementation Date

The large volume of vulnerabilities that have been identified by this effort suggest that the customer needs to implement a plan to deploy an agent-based solution to endpoints to identify vulnerable applications.

For operating systems and applications that can be migrated to supported versions, implement migration plan immediately and also implement mitigation plan below Implement plan to migrate to known secure TLS ciphersuites (TLSv1.2 and above, preferably TLSv1.3 and above). Implement plan for certificate management.

Implement plan to migrate to known secure TLS ciphersuites (TLSv1.2 and above, preferably TLSv1.3 and above). Implement plan for certificate management.

IT Engineering

6/25/21

IT Engineering

6/26/21

IT Crypto

7/1/21

IT Crypto

7/7/21