By default, Piranha installs with a default password. The piranha account has a password of either piranha or q which is publicly known and documented. This allows attackers to trivially access the program or system.
Classification
Location:
Local / Remote
Attack Type:
Authentication Management
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution:
Change Default Setting
Exploit:
Exploit Public
Solution
Immediately after installation, change all default install passwords to a unique and secure password. When possible, change default accounts to custom names as well.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
