Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Wednesday December 09 2015, @01:28AM   Printer-friendly
from the what's-in-a-name? dept.

'Specially crafted username' opens the keys to the kingdom of FAIL:

Designated CVE-2015-8024, the bug covers "McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username 'NGCP|NGCP|NGCP;' and any password", the advisory states.

So, you install a security product and that provides an open backdoor into your systems?


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Wednesday December 09 2015, @01:37AM

    by Anonymous Coward on Wednesday December 09 2015, @01:37AM (#273743)

    Because I have more money than inklings about security.

    • (Score: -1, Redundant) by Anonymous Coward on Wednesday December 09 2015, @02:34AM

      by Anonymous Coward on Wednesday December 09 2015, @02:34AM (#273763)

      Or you work in the US Government. They love McAfee crap.

      • (Score: 2) by Fluffeh on Wednesday December 09 2015, @02:53AM

        by Fluffeh (954) Subscriber Badge on Wednesday December 09 2015, @02:53AM (#273768) Journal

        I think the OP comment still applies perfect to the US Government.

  • (Score: 5, Funny) by BK on Wednesday December 09 2015, @02:10AM

    by BK (4868) on Wednesday December 09 2015, @02:10AM (#273755)

    Seems like this would comply with French law…

    --
    ...but you HAVE heard of me.
  • (Score: 3, Informative) by Fnord666 on Wednesday December 09 2015, @02:22AM

    by Fnord666 (652) on Wednesday December 09 2015, @02:22AM (#273758) Homepage
    Here [nist.gov] is a link to the CVE.
  • (Score: -1, Offtopic) by Anonymous Coward on Wednesday December 09 2015, @02:31AM

    by Anonymous Coward on Wednesday December 09 2015, @02:31AM (#273761)

    Trump just out-crazied you with the GOP crazies. You won't get any votes.

    • (Score: 0, Offtopic) by Runaway1956 on Wednesday December 09 2015, @02:35AM

      by Runaway1956 (2926) Subscriber Badge on Wednesday December 09 2015, @02:35AM (#273764) Homepage Journal

      Crazy is opening your borders to known enemies and unknown enemies. It's a proven fact that none of the western nations is competent at weeding out the bad actors. So, just throw the borders open, and let anyone through. THAT is crazy!

      --
      Abortion is the number one killed of children in the United States.
      • (Score: 0, Informative) by Anonymous Coward on Wednesday December 09 2015, @02:56AM

        by Anonymous Coward on Wednesday December 09 2015, @02:56AM (#273769)

        We let in your ancestors, didn't we? How much vetting was done in that case? Talk about crazy!

        • (Score: 2, Offtopic) by Runaway1956 on Wednesday December 09 2015, @03:31AM

          by Runaway1956 (2926) Subscriber Badge on Wednesday December 09 2015, @03:31AM (#273777) Homepage Journal

          WTF is "we", white boy? Let me reiterate - my ancestors came to this continent in several waves, some of them as early as 20,000 years ago, some as recently as 100 years ago. I'd like to know who you think "we" is.

          Now, some of my ancestors allowed some of my other ancestors onto this continent. Some of my other ancestors resisted others of my ancestors coming here. The upshot is, some of my ancestors died as a result of others of my ancestors arrival here. For better or worse, that is water under the bridge - it's history. What I'm concerned about is the future. There is a new wave of invaders. I, for one, don't intend to become another statistic in the history of defeated people on this continent.

          Islam does not have a history of playing nice with others. If you plan to have an overseer ensuring that you bow down and beat your head on the ground five times each day while facing Mecca, that's alright for you, I guess. I will not.

          --
          Abortion is the number one killed of children in the United States.
          • (Score: 0, Disagree) by Anonymous Coward on Wednesday December 09 2015, @03:52AM

            by Anonymous Coward on Wednesday December 09 2015, @03:52AM (#273783)

            It doesn't matter how *I* got my good seat. What matters is that we set up a PROCESS that doesn't let the riff-raff in!

            It's hard to argue with a deep thinking philosopher.

            • (Score: 1, Troll) by aristarchus on Wednesday December 09 2015, @06:54AM

              by aristarchus (2645) on Wednesday December 09 2015, @06:54AM (#273837) Journal

              Seriously, who thinks Runaway actually knows with any accuracy who his ancestors are? I bet most of them are illegal ancestors. Like, you know, ancestors without documents, with only a deep and abiding desire to, well, you know, ancestorate. What better reason could there be for restricting Muslim immigration exclusively to Arkansaws? Or Arkansaw and Oklahoma? They already have the greatest numbers of, um, something. No, wait! Kansas! Leavenworth! Guantanamo! Racist bastards!

              • (Score: 2) by FatPhil on Wednesday December 09 2015, @09:40AM

                by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Wednesday December 09 2015, @09:40AM (#273866) Homepage
                One of my favourite ways of ever-so-gently winding up annoying Americans is to call Arkansas "Arkansas", rather than "Arkansaw", and Connecticut "Connecticut", rather than "Conneticut". It can work on an individual for sometimes as long as 6 months before they can just shrug it off.
                --
                Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
                • (Score: 2) by aristarchus on Thursday December 10 2015, @06:33AM

                  by aristarchus (2645) on Thursday December 10 2015, @06:33AM (#274292) Journal

                  On the other hand, I find it is always a good idea to give precedence to native place names, and their native pronunciations. Oft I have heard that I am from "Saymous", or worse. Kansas and Arkansas are, of course, the names of the peoples who populated these places, before an unfortunate influx of illegal migrants.

                  • (Score: 2) by FatPhil on Thursday December 10 2015, @08:14AM

                    by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Thursday December 10 2015, @08:14AM (#274334) Homepage
                    My g/f does come from near "be-AT-riss", because the they forgot how to English. Were I to ever visit where her roots are, I would deliberately pronounce it "beer-triss" to wind them up.
                    --
                    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
      • (Score: -1, Offtopic) by Anonymous Coward on Wednesday December 09 2015, @03:35AM

        by Anonymous Coward on Wednesday December 09 2015, @03:35AM (#273779)

        Agreed. No one should let 'Muricans into their country.

        • (Score: 2) by aristarchus on Wednesday December 09 2015, @06:58AM

          by aristarchus (2645) on Wednesday December 09 2015, @06:58AM (#273839) Journal

          Reign of Fire! http://www.imdb.com/title/tt0253556/ [imdb.com] "Only thing worse than dragons: Americans" Line spoken by Gerald Butler, by the way, and given his more recent roles, completely in character. Because this is Sparta! Or Northern England! OR Donald Trump's Hair!!!

      • (Score: 0, Offtopic) by Anonymous Coward on Wednesday December 09 2015, @06:03AM

        by Anonymous Coward on Wednesday December 09 2015, @06:03AM (#273825)

        Runaway did your account get hacked or are you just upping the alcohol intake to prepare for the holidays? This shit seems a little less balanced than usual...

        • (Score: 3, Funny) by aristarchus on Wednesday December 09 2015, @07:02AM

          by aristarchus (2645) on Wednesday December 09 2015, @07:02AM (#273840) Journal

          With Runaway, I usually just check the phase of the moon. Rather reliable indicator. Not claiming causation, but correlation is good enough for prediction. And who would mod down this inquiry into the health of one of our fellow Soylentils! If we don't check up on each other, only the NSA will!

        • (Score: 3, Informative) by Runaway1956 on Wednesday December 09 2015, @02:57PM

          by Runaway1956 (2926) Subscriber Badge on Wednesday December 09 2015, @02:57PM (#273952) Homepage Journal

          I'm afraid that you haven't followed very carefully. Islam is an enemy of just about everybody who isn't Muslim. Islam has factions within it who positively hate everyone who isn't Muslim. It further has factions who positively hate everyone who isn't the correct flavor of Islam.

          Look at the mideast. For as long as the mideast has been there, they have been plagued with violence. Things haven't gotten any better since Islam was established. It's the old status quo of kill everyone who isn't like you, with the addition of a hateful religion.

          I've been saying as much for as long as I've been on the internet, which is much much longer that there has been a Soylentnews.

          Please, show me a nation which has any significant Muslim population which is NOT routinely rocked by terrorist attacks, routine mass executions, slavery, arranged marriages of children,

          You know, what really puzzles me about various people who stick up for Islam is, many of them are the very same people who bash Christianity. They don't understand that all the things they find wrong with Christianity is also wrong with Islam, but a couple orders of magnitude worse.

          --
          Abortion is the number one killed of children in the United States.
          • (Score: 0) by Anonymous Coward on Wednesday December 09 2015, @05:21PM

            by Anonymous Coward on Wednesday December 09 2015, @05:21PM (#274015)

            I'm afraid that you haven't followed very carefully. Islam is an enemy of just about everybody who isn't Muslim. Islam has factions within it who positively hate everyone who isn't Muslim. It further has factions who positively hate everyone who isn't the correct flavor of Islam.

            So basically no different than the other Abrahamic religions. Cool story, brah.

            • (Score: 2) by Runaway1956 on Wednesday December 09 2015, @05:47PM

              by Runaway1956 (2926) Subscriber Badge on Wednesday December 09 2015, @05:47PM (#274028) Homepage Journal

              You're still not paying attention.

              Judaism had a direct relationship with a God who was loving and abusive in turns.

              Christianity had a direct relationship with the Son of God, who was loving and forgiving of sins.

              Islam was founded by a murderous individual who usurped both of the earlier religions, and appropriated God to justify his violence. Unlike the other two religions, he commanded his followers to kill off the infidels, or to enslave them.

              Have you ever read the Quran, or read a biography of Mohammed? If you have, you apparently learned little from it.

              --
              Abortion is the number one killed of children in the United States.
  • (Score: 2) by Username on Wednesday December 09 2015, @02:59AM

    by Username (4557) on Wednesday December 09 2015, @02:59AM (#273770)

    But how do they get around the Kerberos authentication itself?

  • (Score: 0) by Anonymous Coward on Wednesday December 09 2015, @05:50AM

    by Anonymous Coward on Wednesday December 09 2015, @05:50AM (#273820)

    "Hey trust me! Would I ever lie to you baby?!"

  • (Score: 3, Interesting) by mendax on Wednesday December 09 2015, @07:14AM

    by mendax (2840) on Wednesday December 09 2015, @07:14AM (#273842)

    How much do you want to bet that the fix in this bug is not to close the backdoor but to change it?

    --
    It's really quite a simple choice: Life, Death, or Los Angeles.
  • (Score: 2) by wonkey_monkey on Wednesday December 09 2015, @08:43AM

    by wonkey_monkey (279) on Wednesday December 09 2015, @08:43AM (#273853) Homepage

    So, you install a security product and that provides an open backdoor into your systems?

    No?

    --
    systemd is Roko's Basilisk
  • (Score: 0) by Anonymous Coward on Wednesday December 09 2015, @02:50PM

    by Anonymous Coward on Wednesday December 09 2015, @02:50PM (#273951)

    ...open keys. One uses keys to open doors. Kingdom of FAIL indeed. (Specifically the Duchy of Fucked Up Analogies)