Netscape Enterprise Web Server Brute Force Authentication Attacks Vulnerability
BID:3831
Info
Netscape Enterprise Web Server Brute Force Authentication Attacks Vulnerability
| Bugtraq ID: | 3831 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2002 12:00AM |
| Updated: | Jan 09 2002 12:00AM |
| Credit: | Discovered by Richard Brain published in ProCheckUp Security Bulletin PR01-05. Published in Cert Vulnerability Note VU#985347. |
| Vulnerable: |
Sun iPlanet Web Server 6.0 Netscape Enterprise Server 3.6 Netscape Enterprise Server 3.5 Netscape Enterprise Server 3.4 Netscape Enterprise Server 3.3 Netscape Enterprise Server 3.2 Netscape Enterprise Server 3.1 Netscape Enterprise Server 3.0 Netscape Enterprise Server 2.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 |
| Not Vulnerable: | |
Discussion
Netscape Enterprise Web Server Brute Force Authentication Attacks Vulnerability
Netscape Enterprise Server is a web server used to host larger-scale websites. A Web Publishing feature is installed by default. The Enterprise Server runs on Microsoft and most Unix and Linux platforms.
An issue exists in Netscape Enterprise Server, which could allow an unauthorized user to brute force the password of user accounts when Web Publishing is enabled.
Submitting a request containing 'wp-force-auth' will invoke a HTTP Basic Authentication dialog, from there users can use brute force techniques to potentially gain knowledge of the password, associated with known usernames (ie: guest, administrator, nobody etc.).
It should be noted that iPlanet Web Server Enterprise Edition is also vulnerable to this issue.
Netscape Enterprise Server is a web server used to host larger-scale websites. A Web Publishing feature is installed by default. The Enterprise Server runs on Microsoft and most Unix and Linux platforms.
An issue exists in Netscape Enterprise Server, which could allow an unauthorized user to brute force the password of user accounts when Web Publishing is enabled.
Submitting a request containing 'wp-force-auth' will invoke a HTTP Basic Authentication dialog, from there users can use brute force techniques to potentially gain knowledge of the password, associated with known usernames (ie: guest, administrator, nobody etc.).
It should be noted that iPlanet Web Server Enterprise Edition is also vulnerable to this issue.
Exploit / POC
Netscape Enterprise Web Server Brute Force Authentication Attacks Vulnerability
No exploit code is required.
No exploit code is required.
Solution / Fix
Netscape Enterprise Web Server Brute Force Authentication Attacks Vulnerability
Solution:
The following solution has been taken from the iPlanet Knowledge Base Article ID: 7764:
When you enable web publishing, you should treat the web server as an environment that must be secured. Ensure that users follow proper password policies such as using hard to guess passwords. If intruder detection software is used, it should be configured to check for ?wp-force-auth requests.
HTTP basic authentication is generally not considered a secure mechanism and should be run over a SSL-enabled port. In addition, access logs should be monitored for suspicious requests. A better alternative would be to use client certificates, which are much more secure.
Solution:
The following solution has been taken from the iPlanet Knowledge Base Article ID: 7764:
When you enable web publishing, you should treat the web server as an environment that must be secured. Ensure that users follow proper password policies such as using hard to guess passwords. If intruder detection software is used, it should be configured to check for ?wp-force-auth requests.
HTTP basic authentication is generally not considered a secure mechanism and should be run over a SSL-enabled port. In addition, access logs should be monitored for suspicious requests. A better alternative would be to use client certificates, which are much more secure.
References
Netscape Enterprise Web Server Brute Force Authentication Attacks Vulnerability
References:
References:
- ?wp-force-auth can be used in a brute force password cracking attack (iPlanet)
- Security Bulletin PR01-05 (ProCheckUp)