Lightwave ConsoleServer 3200 Information Disclosure Vulnerability
BID:2578
Info
Lightwave ConsoleServer 3200 Information Disclosure Vulnerability
| Bugtraq ID: | 2578 |
| Class: | Access Validation Error |
| CVE: |
CVE-2001-0395 CVE-2001-0396 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 10 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | Reported to bugtraq by John McInnes <[email protected]> on Wed, 11 Apr 2001 |
| Vulnerable: |
Lightwave ConsoleServer 3200 |
| Not Vulnerable: | |
Discussion
Lightwave ConsoleServer 3200 Information Disclosure Vulnerability
The ConsoleServer 3200 is a console switch from Lightwave.
The unit's remote administration interface supplies sensitive information to connected users who have not yet successfully logged into an administrative account.
The "pre-login" banner reveals a range of important data to non-authenticated users, including the userids of other connected users, as well as information about the device's hardware configuration and status.
Properly exploited (for example, by obtaining usernames which are then used in brute-force password analysis), this information could be used to carry out attacks and potentially compromise the device.
The ConsoleServer 3200 is a console switch from Lightwave.
The unit's remote administration interface supplies sensitive information to connected users who have not yet successfully logged into an administrative account.
The "pre-login" banner reveals a range of important data to non-authenticated users, including the userids of other connected users, as well as information about the device's hardware configuration and status.
Properly exploited (for example, by obtaining usernames which are then used in brute-force password analysis), this information could be used to carry out attacks and potentially compromise the device.
Exploit / POC
Lightwave ConsoleServer 3200 Information Disclosure Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Lightwave ConsoleServer 3200 Information Disclosure Vulnerability
Solution:
Shortly, there will be a hardware upgrade, in the form of a new network card (swappable with the current card), which will essentially be a "system on a chip" running Linux. This> will enable various secure authentication schemes to be implemented. SSH will be supported initially. The "system on a chip" architecture will become standard across the product line. Expect availability this summer.
---
Solution:
Shortly, there will be a hardware upgrade, in the form of a new network card (swappable with the current card), which will essentially be a "system on a chip" running Linux. This> will enable various secure authentication schemes to be implemented. SSH will be supported initially. The "system on a chip" architecture will become standard across the product line. Expect availability this summer.
---
References
Lightwave ConsoleServer 3200 Information Disclosure Vulnerability
References:
References:
- ConsoleServer 3200 (Lightwave)