Cognos Powerplay Web Edition Weak Temp File Name Vulnerability
BID:3035
Info
Cognos Powerplay Web Edition Weak Temp File Name Vulnerability
| Bugtraq ID: | 3035 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 28 1999 12:00AM |
| Updated: | Jun 28 1999 12:00AM |
| Credit: | This vulnerability was discovered by Darin White <[email protected]> and submitted to BugTraq on June 28th, 1999. |
| Vulnerable: |
Cognos Powerplay Web Edition 6.5 Cognos Powerplay Web Edition 6.0 Cognos Powerplay Web Edition 5.21 Cognos Powerplay Web Edition 5.0 1 Cognos Powerplay Web Edition 4.1 Cognos Powerplay Web Edition 4.0 |
| Not Vulnerable: |
Cognos Powerplay Web Edition 6.61 |
Exploit / POC
Cognos Powerplay Web Edition Weak Temp File Name Vulnerability
Darin White <[email protected]> included this example in his June 28th, 1999 BugTraq posting:
Using the guest account or viewing an unprotected cube a user may right-click the content area and select View Frame Info which will display the temporary filename. By repeatedly reloading the initial cube view and viewing frame info a list of temporary filenames may be generated in order to analyze the filename algorithm. e.g. http://www.example.com/ppwb/Temp/1eeex.htm http://www.example.com/ppwb/Temp/1f77x.htm http://www.example.com/ppwb/Temp/1fcfx.htm http://www.example.com/ppwb/Temp/1ff6x.htm http://www.example.com/ppwb/Temp/2014x.htm Analysis of the filename progression shows: * the last char is 'x' for the data and 't' for the toolbar * first n-1 chars are hexadecimal chars only * the hexadecimal "numbers" comprising the filename are ascending only * the first char is never 0. e.g. fffx.htm => 1000x.htm * simple hexadecimal subtraction on the first n-1 chars of consecutive filenames shows a very predictable pattern.
Darin White <[email protected]> included this example in his June 28th, 1999 BugTraq posting:
Using the guest account or viewing an unprotected cube a user may right-click the content area and select View Frame Info which will display the temporary filename. By repeatedly reloading the initial cube view and viewing frame info a list of temporary filenames may be generated in order to analyze the filename algorithm. e.g. http://www.example.com/ppwb/Temp/1eeex.htm http://www.example.com/ppwb/Temp/1f77x.htm http://www.example.com/ppwb/Temp/1fcfx.htm http://www.example.com/ppwb/Temp/1ff6x.htm http://www.example.com/ppwb/Temp/2014x.htm Analysis of the filename progression shows: * the last char is 'x' for the data and 't' for the toolbar * first n-1 chars are hexadecimal chars only * the hexadecimal "numbers" comprising the filename are ascending only * the first char is never 0. e.g. fffx.htm => 1000x.htm * simple hexadecimal subtraction on the first n-1 chars of consecutive filenames shows a very predictable pattern.
Solution / Fix
Cognos Powerplay Web Edition Weak Temp File Name Vulnerability
Solution:
The vendor has addressed this issue in further releases.
Solution:
The vendor has addressed this issue in further releases.
References
Cognos Powerplay Web Edition Weak Temp File Name Vulnerability
References:
References:
- Powerplay Web Edition Product Page (Cognos)