BID:3784

Lucent VitalNet Password Authentication Bypass Vulnerability

Info

Lucent VitalNet Password Authentication Bypass Vulnerability

Bugtraq ID:	3784
Class:	Design Error
CVE:	CVE-2002-0236
Remote:	Yes
Local:	No
Published:	Jan 16 2002 12:00AM
Updated:	Jul 11 2009 09:56AM
Credit:	This vulnerability was discovered by Mark Cooper.
Vulnerable:	Lucent VitalSuite 8.2 Lucent VitalSuite 8.1 Lucent VitalSuite 8.0 Lucent VitalNet 8.2 Lucent VitalNet 8.1 Lucent VitalNet 8.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 Lucent VitalHelp 8.2 Lucent VitalHelp 8.1 Lucent VitalHelp 8.0 Lucent VitalEvent 8.2 Lucent VitalEvent 8.1 Lucent VitalEvent 8.0 Lucent VitalAnalysis 8.2 Lucent VitalAnalysis 8.1 Lucent VitalAnalysis 8.0

Not Vulnerable:

Discussion

Lucent VitalNet Password Authentication Bypass Vulnerability

VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users to monitor, analyze, manage and predict the performance of their network infrastructure.

The implementation of VitalNet's cookie-based authentication mechanism is flawed. An attacker who successfully guesses a correct username can gain access to the server without need of a valid password.

Exploit / POC

Lucent VitalNet Password Authentication Bypass Vulnerability

The following example was submitted:

http://<serverip>/cgi-bin/VsSetCookie.exe?vsuser=<user_name>