Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

A security analyst conducts an audit of an internal management server and inspects the following listening socket bindings and active process report:

Proto Local Address Foreign Address State PID/Program name
tcp 0.0.0.0:21 0.0.0.0:* LISTEN 812/vsftpd
tcp 0.0.0.0:5900 0.0.0.0:* LISTEN 1044/vncserver
tcp 127.0.0.1:9090 0.0.0.0:* LISTEN 1120/cockpit-daemon

Further investigation confirms that `vncserver` is configured without password authentication and accepts connections from any source IP. Which of the following represents the primary root cause host and architecture vulnerability in this deployment?

  1. Insecure service configuration allowing unauthenticated binding to wildcard network interfacesAnswer
  2. B
    Over-reliance on perimeter firewalls to protect unauthenticated internal management services
  3. C
    Failure to apply network-level packet filtering firewalls to mitigate software memory corruption vulnerabilities
  4. D
    Misclassification of remote management software as a detective security control rather than a preventive control

Answer

Insecure service configuration allowing unauthenticated binding to wildcard network interfaces
The socket audit shows VNC bound to `0.0.0.0:5900`, exposing the service across all network interfaces. Combined with disabled authentication, any internal network host can establish a remote desktop session. The root vulnerability is the insecure host service configuration.

Step-by-Step Solution

1
Analyze the socket output
The process `vncserver` is listening on `0.0.0.0:5900`, which means it listens on all network interfaces.
Identifying the socket binding reveals the exposure surface of the service.
2
Evaluate the service configuration details
The VNC service requires no password authentication.
Determining authentication requirements exposes the root security vulnerability.
3
Identify the primary architecture flaw
An unauthenticated remote desktop daemon listening on all host network interfaces creates an immediate unauthorized access risk.
Host security configuration dictates whether network exposure leads to compromise.

Key Concept

Host and Architecture Vulnerabilities - Insecure Service Configuration and Network Socket Exposure
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities