SAFE TEAM Regulus Customer Statistics Information Disclosure Vulnerability

Bugtraq ID:	11134
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2004 12:00AM
Updated:	Sep 07 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to [email protected].
Vulnerable:	SAFE TEAM Regulus 2.2 -95
Not Vulnerable:

SAFE TEAM Regulus Customer Statistics Information Disclosure Vulnerability

Regulus is reported prone to an information disclosure vulnerability. It is reported that it is possible to view a target users connection statistics without requiring valid credentials.

An attacker may employ data that is obtained in this manner to aid in further attacks launched against the vulnerable software.

This vulnerability is reported to affect all versions of SAFE TEAM Regulus.

SAFE TEAM Regulus Customer Statistics Information Disclosure Vulnerability

There is no exploit required; the following request is sufficient to exploit this vulnerability:

http://example.com/base-dir/htmlcust/custchoice.php?lang=English&userid=<name>&action=To see your connections logs

Where '<name>' is the target username.

SAFE TEAM Regulus Customer Statistics Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SAFE TEAM Regulus Customer Statistics Information Disclosure Vulnerability

References:

• REGULUS EXPOSED ([email protected])
  
• Regulus Homepage (SAFE TEAM)