header-logo
Suggest Exploit
vendor:
ComStock
by:
Unknown
7.5
CVSS
HIGH
Multiple vulnerabilities
CWE
Product Name: ComStock
Affected Version From: ComStock product based on RedHat 5.1 distribution
Affected Version To: ComStock product based on RedHat 5.1 distribution
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:
Unknown

Vulnerabilities in ComStock product

The ComStock product, based on the RedHat 5.1 distribution, has numerous vulnerabilities including weak or nonexistent passwords and easily guessable accounts. The machines can be compromised using well-known passwords and RedHat 5.1 exploits.

Mitigation:

Implement strong passwords for all accounts, regularly update the ComStock product to the latest version, and apply necessary security patches.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1080/info

Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1 distribution. In addition, it contains numerous accounts with weak, or nonexistent passwords.

The ComStock MultiCSP machine is intended to provide a realtime stock quote stream. It runs a proprietary service called 'mcsp' to provide this service. These machines acquire their data via a leased line, or other dedicated data connection. They used reserved address space. However, no attempt is made to prevent these ComStock machines from being used to compromise other machines on the private network. In addition, the routers utilized on the private network these machines communicate over are internet-accessible. 

There are numerous accounts with easily guessable passwords. The following are well known passwords:
User: root Password: c0mst0ck
User: helpmcsp: Password: (none)
User: helpicl Password: (none)

The helpmcsp and helpicl accounts will display a set of help to the user accessing these accounts, using the 'more' command. Shell level access can be gained as follows:
Hit 'v' to bring up the file in vi
:set shell=/bin/bash <RETURN>
:shell <RETURN>

In addition, many RedHat 5.1 exploits should allow for the compromise of these machines.
cqrsecured