Davy Douhine
0day
Bull/IBM Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters.
Marble effect in the web banner and questionable font: it smells the 90s !
Tool is mainly a web app with CGIs (shell scripts and binaries) and we have found three vulnerabilities in it:
Trivial admin credentials Authenticated user can write on the system file Authenticated user can inject OS commands By combining these three vulnerabilities an attacker can fully compromise servers running Watchware.
