Hummingbird Enterprise Collaboration Multiple Vulnerabilities
BID:16195
Info
Hummingbird Enterprise Collaboration Multiple Vulnerabilities
| Bugtraq ID: | 16195 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 10 2006 12:00AM |
| Updated: | Jan 10 2006 12:00AM |
| Credit: | Discovered by Luca Carettoni and Federico Maggi. |
| Vulnerable: |
Nortel Networks VPN Router 1700 5.2.1 Nortel Networks VPN Router 1700 5.2 |
| Not Vulnerable: | |
Discussion
Hummingbird Enterprise Collaboration Multiple Vulnerabilities
Hummingbird Enterprise Collaboration is prone to multiple vulnerabilities.
The following specific issues were identified:
The application reportedly allows remote attackers to upload arbitrary HTML files and script code to the application.
Another vulnerability allows attackers to trick users into downloading potentially malicious files.
An attacker may also disclose sensitive information about the server by sending specially crafted HTTP GET requests.
Hummingbird Enterprise Collaboration 5.2.1 and prior versions are vulnerable to these issues.
Hummingbird Enterprise Collaboration is prone to multiple vulnerabilities.
The following specific issues were identified:
The application reportedly allows remote attackers to upload arbitrary HTML files and script code to the application.
Another vulnerability allows attackers to trick users into downloading potentially malicious files.
An attacker may also disclose sensitive information about the server by sending specially crafted HTTP GET requests.
Hummingbird Enterprise Collaboration 5.2.1 and prior versions are vulnerable to these issues.
Exploit / POC
Hummingbird Enterprise Collaboration Multiple Vulnerabilities
An exploit is not required.
The following proof of concept examples are available:
To trick users into downloading a potentially malicious file, the file is named 'fake.doc', however, a file with the ID of 1189762 is actually downloaded:
https://www.example.com/hc/hc/fake.doc?d=fc&o=dwnd&fid=1189762&did=89777&x=16080&doc_ext=.txt
To disclose the internal IP address:
https://www.example.com/hc/hc?d=mes&x=20433&ntb=[numericParam]
Where the ntb parameter is supplied a numeric value instead of a string value. The internal IP address of the server may be found in a cookie.
An exploit is not required.
The following proof of concept examples are available:
To trick users into downloading a potentially malicious file, the file is named 'fake.doc', however, a file with the ID of 1189762 is actually downloaded:
https://www.example.com/hc/hc/fake.doc?d=fc&o=dwnd&fid=1189762&did=89777&x=16080&doc_ext=.txt
To disclose the internal IP address:
https://www.example.com/hc/hc?d=mes&x=20433&ntb=[numericParam]
Where the ntb parameter is supplied a numeric value instead of a string value. The internal IP address of the server may be found in a cookie.
Solution / Fix
Hummingbird Enterprise Collaboration Multiple Vulnerabilities
Solution:
Reports indicate that the vendor has addressed these issues in the latest version of the application. Symantec was not able to confirm this information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Reports indicate that the vendor has addressed these issues in the latest version of the application. Symantec was not able to confirm this information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Hummingbird Enterprise Collaboration Multiple Vulnerabilities
References:
References: