CVE-2022-3703 The ETIC Telecom RAS 4.5.0 and earlier is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and privilege escalation.
Remote attackers may be able to access sensitive information, intercept, or modify traffic that passes through the RAS appliance. ETIC Telecom recommends all customers upgrade to ETIC Telecom Remote Access Server 5.0.0 or newer, which is not vulnerable to this issue. ETIC Telecom has patched the issue in version 5.0.1. ETIC Telecom has released an update to version 5.0.1 to address this issue. To update your appliance, log into the ETIC Telecom Remote Access Server web portal, select “System Configuration” from the menu, select “Firmware” from the “System” menu, and update the system firmware.
Remote Authentication Service (RAS)
An RAS is a software module used to manage access to a remote computer over a network. A RAS can be configured to allow remote users to log in by using their credentials and/or by providing a passphrase that they must enter. The RAS uses this information to establish the connection with the user, and then authenticates them. To increase security, most RASs use encryption for authentication and data transfer. For example, an RSA private key can be used for authentication. There are various types of RASes available today including Radius based systems (such as RADIUS), Kerberos-based systems, and SSL-based systems.
To learn more about Remote Authentication Service, visit the following URLs:
Remote Access Server (RAS) Vulnerabilities Overview
Remote access servers are an important part of the network security, providing remote access to computers or other devices. RAS appliances are designed to be a secure, manageable and efficient way to connect users and devices without depending on a centralized authentication server. There are a number of vulnerabilities that have been discovered in remote servers in recent years. One common vulnerability found is privilege escalation, which is when an unauthorized user with elevated privileges gains access to sensitive information or can modify traffic passing through the RAS appliance.
Product Overview
ETIC Telecom Remote Access Server is a remote access VPN appliance that provides secure, reliable, and redundant connections to the corporate network. The ETIC Telecom Remote Access Server offers advanced features such as channel bonding, remote access servers on multiple networks, and network address translation (NAT).
Bug Finding and Analysis
CVE-2022-3703 is a vulnerability that was found in the ETIC Telecom Remote Access Server. Remote attackers may be able to access sensitive information, intercept or modify traffic that passes through the RAS appliance. The vulnerability was patched in version 5.0.1 but because this product is not at a patch level of 5.1 and later, remote attackers are still able to exploit this vulnerability. This issue affects the entire product line and all customers should update their software as soon as possible to avoid being vulnerable to an attack like this one.
RAS Management Console (RMC) Upgrade
Prior to upgrading the RAS Management Console (RMC), ensure you are running the following software versions on your appliance:
Version 5.0.0 or newer of ETIC Telecom Remote Access Server; and
GSM-SUMMARY-SECURITY-CERTIFICATE version 4.2.1 or newer of the GSM-SUMMARY-SECURITY-CERTIFICATE software package in your RAS Management Console (RMC).
Note: The GSM-SUMMARY-SECURITY-CERTIFICATE software package is available in the "Extras" tab of the RMC web portal under Software Package Downloads.
If you are using a version prior to 5.0.0, please update your appliance to at least 5.0.1 and follow these steps:
Step 1: Log into your Remote Access Server IP address (web portal) _______ ____ ____ without any password and click on “Software Update” from the left menu bar icon
Step 2: Select “System Configuration” from the pull down menu, then select “Firmware” from the drop down menu, and update the system firmware
Step 3: Restart your remote access server for this change to take effect
Timeline
Published on: 11/10/2022 22:15:00 UTC
Last modified on: 11/16/2022 14:58:00 UTC