NetOp School Administration Authentication Vulnerability

Bugtraq ID:	3321
Class:	Access Validation Error
CVE:	CVE-2001-1094
Remote:	No
Local:	Yes
Published:	Sep 11 2001 12:00AM
Updated:	Jul 11 2009 07:56AM
Credit:	This vulnerability was posted to BugTraq by Jesse Smythe <[email protected]>.
Vulnerable:	CrossTec Corp NetOp School 1.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:	CrossTec Corp NetOp School 2.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0

NetOp School Administration Authentication Vulnerability

NetOp School is classroom software that allows an instructor to view, control, and broadcast to student terminals.

A malicious user can run the administrative component of the software without being challenged for any authentication.

This could allow an attacker to browse other PCs in the classroom network.

NetOp School Administration Authentication Vulnerability

There is no exploit code necessary for this vulnerability.

NetOp School Administration Authentication Vulnerability

Solution:
The vendor has addressed these problems in NetOp School v2.0.

NetOp School Administration Authentication Vulnerability

References:

• NetOp School for Windows (CrossTec Corp)