Classification: FMOS

Category: Security issue

Severity: Critical

Summary

The root account is unlocked. A password has been assigned to it, allowing users to access it using the su command.

Description

Under normal circumstances, the root user account should be locked. It should not have a password assigned to it, and it should never be used directly by users. FMOS provides the necessary tools to deploy, manage, and maintain the Security Intelligence Platform suite, so there is never any reason to use the root account directly.

Once the root account has been unlocked, the security, reliability, and consistency of a machine running FMOS can no longer be guaranteed. Because of this, it is impossible for FireMon to offer support for such systems. FireMon will be unable to reproduce or diagnose issues that arise on systems with an unlocked root account, and as such cannot offer any assistance in resolving them.

Resolution

If the root account has ever been unlocked, even temporarily, there is no way to guarantee the security and consistency of the system. If a user has ever had the ability to execute arbitrary privileged operations, it is impossible to ensure that the user did not install a "back door" access method, allowing access to the root account even if it is locked again.

A system that has been compromised in this way cannot be recovered. Data must be copied to another system, for example by using a backup, and fully audited to ensure that it was not damaged. Further, because the Security Intelligence Platform, by its nature, handles sensitive credentials for network devices, those devices may also be at risk of compromise. Any credentials accessible to SIP should be invalidated immediately.