ViRobot Linux Server Authentication Bypass Vulnerability

Bugtraq ID:	16768
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 22 2006 12:00AM
Updated:	Feb 23 2006 06:17PM
Credit:	Discovered by dong-houn yoU.
Vulnerable:	ViRobot Linux Server 2.0
Not Vulnerable:

ViRobot Linux Server Authentication Bypass Vulnerability


ViRobot Linux Server is prone to an authentication-bypass vulnerability.

Remote attackers can exploit this issue to gain access to the application's file-scanning functionality.

Presumably, the exploitation of this issue may allow attackers to carry out other attacks, such as triggering denial-of-service conditions by scanning a large number of large files. Other attacks due to latent vulnerabilities in the application are possible.

ViRobot Linux Server 2.0 (20050817) is reportedly vulnerable. Other versions may be affected as well.

ViRobot Linux Server Authentication Bypass Vulnerability


An exploit is not required.

ViRobot Linux Server Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

ViRobot Linux Server Authentication Bypass Vulnerability

References:

• INetCop Security Advisory #2006-0x82-028 (dong-houn yoU)
  
• ViRobot Vendor Page (Hauri)