Rittal CMC-TC Processing Unit II Administrator Session ID Security Bypass Vulnerability

Bugtraq ID:	34217
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 23 2009 12:00AM
Updated:	Mar 24 2009 04:56PM
Credit:	Henri Lindberg
Vulnerable:	Rittal CMC-TC Processing Unit II DK 7320.100 2.60a Rittal CMC-TC Processing Unit II DK 7320.100 2.45
Not Vulnerable:

Rittal CMC-TC Processing Unit II Administrator Session ID Security Bypass Vulnerability

Rittal CMC-TC Processing Unit II is prone to a vulnerability that can allow an attacker to predict the administrator session ID.

Attackers can exploit this issue to hijack administrator HTTP sessions, which can lead to further attacks.

The CMC-TC Processing Unit II 2.45 and 2.60a are vulnerable; other versions may also be affected.

Rittal CMC-TC Processing Unit II Administrator Session ID Security Bypass Vulnerability

To exploit this issue, an attacker can use a browser. To predict the session ID, the attacker can use readily available tools.

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/Louhi_CMC-brute_090323.zip

Rittal CMC-TC Processing Unit II Administrator Session ID Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Rittal CMC-TC Processing Unit II Administrator Session ID Security Bypass Vulnerability

References:

• Rittal Homepage (Rittal)
  
• Rittal CMC-TC Processing Unit II multiple vulnerabilities (Henri Lindberg - Smilehouse Oy )