NetSupport Manager Gateway HTTP Protocol Information disclosure vulnerability

Bugtraq ID:	44629
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 03 2010 12:00AM
Updated:	Nov 03 2010 07:57PM
Credit:	Matthew Whitehead
Vulnerable:	NetSupport NetSupport Manager 10.60.6 NetSupport NetSupport Manager 10.60.5 NetSupport NetSupport Manager 10.20.5 NetSupport NetSupport Manager 10.20.4 NetSupport NetSupport Manager 10.20 NetSupport NetSupport Manager 10.00
Not Vulnerable:	NetSupport NetSupport Manager 11.0.5

NetSupport Manager Gateway HTTP Protocol Information disclosure vulnerability

NetSupport Manager Gateway HTTP Protocol is prone to a remote information-disclosure vulnerability because it fails to encrypt sensitive information transmitted over the network.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

Versions prior to NetSupport Manager 11.00.0005 are vulnerable.

NetSupport Manager Gateway HTTP Protocol Information disclosure vulnerability

An attacker can exploit this issue using readily available tools.

NetSupport Manager Gateway HTTP Protocol Information disclosure vulnerability

Solution:
Updates are available; please see the references for more information.

NetSupport Manager Gateway HTTP Protocol Information disclosure vulnerability

References:

• NetSupport Manager Gateway Security Issue (NetSupport )
  
• NetSupport Manager Gateway transmits identifying information in plaintext (Michael Orlando)