GCVE-110-CERTCC-2022-142546

### Overview SMA Technologies OpCon UNIX agent adds the same SSH key on every installation and subsequent updates. An attacker with access to the private key can gain root access on affected systems. ### Description During OpCon UNIX agent installation and updates, an SSH public key is added to the root account's `authorized_keys` file. The corresponding private key titled `sma_id_rsa` is included with the installation files and is not encrypted with a passphrase. Removal of the OpCon software does not remove the entry from the `authorized_keys` file. ### Impact An attacker with access to the private key included with the OpCon UNIX agent installation files can gain SSH access as root on affected systems. ### Solution #### Remove private key SMA Technologies has [provided a tool](https://smatechnologies.hosted-by-files.com/SMAUnixLSAMVulnerabilityFix/) to address the issue. Another option is to manually remove the SSH key entry from root's `authorized_keys` file. The key can be identified by its fingerprints: `SHA256:qbgTVNkLGI5G7erZqDhte63Vpw+9g88jYCxMuh8cLeg` `MD5:f1:6c:c9:ba:21:66:ce:7c:5a:55:e2:4d:07:72:cc:31` Depending on the shell and operating system there are [various ways](https://serverfault.com/questions/413231/how-to-get-all-fingerprints-for-ssh-authorized-keys2-file) to generate fingerprints for public keys listed in `authorized_keys`. #### Upgrade SMA Technologies [reports](https://kb.cert.org/vuls/id/142546#SMA%20Technlogies) that "We have updated our UNIX agent version 21.2 package to no longer include (and also remove) any existing vulnerability." ### Acknowledgements Thanks to Nick Holland at Holland Consulting for researching and reporting this vulnerability. This document was written by Kevin Stephens.