How to remediate – NetIQ Privileged User Manager Default Admin Password

1. Introduction

The NetIQ Privileged User Manager Default Admin Password vulnerability involves a web application using well-known default credentials for its ‘admin’ user account. This allows unauthorised access to sensitive systems and data. Systems running NetIQ Privileged User Manager with the default admin password are at risk. Successful exploitation could compromise confidentiality, integrity, and availability of privileged accounts.

2. Technical Explanation

Nessus successfully logged in using the default ‘admin’ credentials for the NetIQ Privileged User Manager web application. This is due to a configuration oversight where the administrator account retains its factory settings. An attacker can gain administrative access without needing valid user credentials.

• Root cause: The use of default, known credentials for the ‘admin’ user account.
• Exploit mechanism: An attacker attempts to log in to the NetIQ Privileged User Manager web interface using the username ‘admin’ and a common default password. If successful, they gain full administrative control.
• Scope: This affects installations of NetIQ Privileged User Manager where the default admin password has not been changed. Specific versions are not known from this report.

3. Detection and Assessment

You can confirm vulnerability by attempting to log in with default credentials, or by reviewing configuration files for unchanged passwords.

• Quick checks: Access the NetIQ Privileged User Manager login page and attempt a login using username ‘admin’ and password ‘password’.
• Scanning: Nessus plugin ID 16839 can identify this vulnerability. Other scanners may have similar checks.
• Logs and evidence: Review application logs for successful logins with the ‘admin’ account, particularly if they originate from an unexpected source IP address.

# No command available to check directly without access to the NetIQ Privileged User Manager system. Accessing the login page is the best initial check.

4. Solution / Remediation Steps

Change the default ‘admin’ password immediately.

4.1 Preparation

• Ensure you have an alternative method to access the system in case of issues, such as console access. A roll back plan is to restore from backup.
• A change window may be needed depending on your organisation’s policy. Approval should be obtained from the IT security team.

4.2 Implementation

1. Step 1: Log in to the NetIQ Privileged User Manager web interface using the default ‘admin’ credentials.
2. Step 2: Navigate to the administration or user management section of the application.
3. Step 3: Locate the ‘admin’ user account.
4. Step 4: Change the password for the ‘admin’ account to a strong, unique value.
5. Step 5: Log out and verify access with the new credentials.

4.3 Config or Code Example

There is no config or code change directly involved; this is an administrative password reset.

Before

Username: admin, Password: password

After

Username: admin, Password: [StrongUniquePassword]

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability include safe defaults and regular password changes.

• Practice 1: Enforce strong passwords for all accounts, including default accounts.
• Practice 2: Regularly review and update system configurations to identify and remove insecure settings like default credentials.

4.5 Automation (Optional)

No automation is suitable for this vulnerability.

5. Verification / Validation

Confirm the fix by attempting to log in with the original default credentials, which should now fail. Verify access with the new password.

• Post-fix check: Attempt a login using username ‘admin’ and password ‘password’. Expected output: Login failed due to invalid credentials.
• Re-test: Re-run the quick check from section 3, which should no longer succeed.
• Smoke test: Verify that administrative functions are still accessible with the new password.

Attempting to log in as admin/password should result in an authentication failure message.

6. Preventive Measures and Monitoring

Update security baselines to include checks for default credentials, and incorporate configuration reviews into deployment pipelines.

• Baselines: Update your system hardening baseline or CIS control checklist to specifically check for the presence of default passwords on all systems.
• Pipelines: Include a configuration scan in your CI/CD pipeline that flags any instances of default credentials being used.
• Asset and patch process: Implement a regular review cycle for system configurations, including password policies.

7. Risks, Side Effects, and Roll Back

Changing the admin password could disrupt access if not communicated properly. A roll back involves restoring from backup.

• Risk or side effect 1: Loss of administrative access if the new password is forgotten or lost. Mitigation: Document the new password securely.
• Risk or side effect 2: Potential service interruption during password change, depending on application dependencies. Mitigation: Perform the change during a maintenance window.
• Roll back: Restore from the pre-change backup of the NetIQ Privileged User Manager database and virtual machine snapshot.

8. References and Resources

Links to official advisories are not available in this context.

• Vendor advisory or bulletin: Not provided.
• NVD or CVE entry: Not provided.
• Product or platform documentation relevant to the fix: Not provided.