Micromuse Netcool/NeuSecure Website NS Account Password Disclosure Vulnerability

Bugtraq ID:	17032
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 08 2006 12:00AM
Updated:	Mar 11 2006 12:05AM
Credit:	Discovered by Dimitry Snezhkov.
Vulnerable:	Micromuse Netcool/Neusecure 3.0.236 -1
Not Vulnerable:

Micromuse Netcool/NeuSecure Website NS Account Password Disclosure Vulnerability


Micromuse Netcool/NeuSecure is prone to an NS account password-disclosure vulnerability. Gaining access to this password could allow an attacker administrative access to the backend MySQL database.

Neusecure 3.0.236-1 was reported vulnerable. Other versions may also be affected.

Micromuse Netcool/NeuSecure Website NS Account Password Disclosure Vulnerability


This issue can be exploited through a web client.

Micromuse Netcool/NeuSecure Website NS Account Password Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Micromuse Netcool/NeuSecure Website NS Account Password Disclosure Vulnerability

References:

• Home Page (Micromuse)
  
• Netcool/Neusecure (Micromuse)
  
• Remote access to NeuSecure/Netcool backend database via web interface credential (DDSi)