Accoria Rock Web Server Multiple Security Vulnerabilities
BID:40498
Info
Accoria Rock Web Server Multiple Security Vulnerabilities
| Bugtraq ID: | 40498 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 01 2010 12:00AM |
| Updated: | Jun 01 2010 12:00AM |
| Credit: | Ilja van Sprundel |
| Vulnerable: |
Accoria Networks Rock Web Server 1.4.7 |
| Not Vulnerable: | |
Discussion
Accoria Rock Web Server Multiple Security Vulnerabilities
Accoria Rock Web Server is prone to multiple security vulnerabilities, including cross-site scripting, cross-site request-forgery, directory-traversal, and format-string issues. A security weakness affects session-cookie generation.
Attackers can leverage these issues to execute arbitrary code, cause denial-of-service conditions, steal or guess cookie-based authentication credentials, or obtain sensitive information. Other attacks are also possible.
Rock Web Server 1.4.7 is vulnerable; other versions may also be affected.
Accoria Rock Web Server is prone to multiple security vulnerabilities, including cross-site scripting, cross-site request-forgery, directory-traversal, and format-string issues. A security weakness affects session-cookie generation.
Attackers can leverage these issues to execute arbitrary code, cause denial-of-service conditions, steal or guess cookie-based authentication credentials, or obtain sensitive information. Other attacks are also possible.
Rock Web Server 1.4.7 is vulnerable; other versions may also be affected.
Exploit / POC
Accoria Rock Web Server Multiple Security Vulnerabilities
To exploit cross-site scripting or cross-site request-forgery issues, an attacker must entice an unsuspecting user into following a malicious URI. The remaining issues may be exploited with readily available tools.
To exploit cross-site scripting or cross-site request-forgery issues, an attacker must entice an unsuspecting user into following a malicious URI. The remaining issues may be exploited with readily available tools.
Solution / Fix
Accoria Rock Web Server Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Accoria Rock Web Server Multiple Security Vulnerabilities
References:
References:
- Multiple Vulnerabilities in Accoria Web Server (IOActive Security)
- Rock Web Server Homepage (Accoria Networks)
- VU#245081 Accoria Rock Web Server contains multiple vulnerabilities (US-CERT)