Dragon-Fire IDS Vulnerability
BID:564
Info
Dragon-Fire IDS Vulnerability
| Bugtraq ID: | 564 |
| Class: | Unknown |
| CVE: |
CVE-1999-0913 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Aug 05 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Stefan Laudat Wed Aug 04 1999. |
| Vulnerable: |
Network Security Wizards Dragon-Fire IDS 1.0 |
| Not Vulnerable: | |
Discussion
Dragon-Fire IDS Vulnerability
The Dragon-Fire IDS remote web interface under version 1.0 has an insecure CGI script which allows for users to remotely execute commands as the user nobody. This could lead to a remote compromise of the system running Dragon-Fire.
The Dragon-Fire IDS remote web interface under version 1.0 has an insecure CGI script which allows for users to remotely execute commands as the user nobody. This could lead to a remote compromise of the system running Dragon-Fire.
Exploit / POC
Dragon-Fire IDS Vulnerability
Via the web interface for Dragon-Fire inside the IPONE field type your desired command prefaced with a | an example could be:
|echo 'uname -a'
The output of the command will then be displayed in the right hand window of the IDS WWW interface.
Via the web interface for Dragon-Fire inside the IPONE field type your desired command prefaced with a | an example could be:
|echo 'uname -a'
The output of the command will then be displayed in the right hand window of the IDS WWW interface.
Solution / Fix
Dragon-Fire IDS Vulnerability
Solution:
NSW issued an immediate fix to its user community via a customer security bulletin. The fix instructions here are taken from this bulletin.
If you have Dragon-Fire exposed to the Internet, please modify it
now and take the steps outlined here to patch it.
1] Open dfire.cgi with vi.
2] Goto to line 215 with a ':215' command
3] The line should read:
$command = $command . '-f ' . $db . $input{'database'} .
'/dragon.db';
It may be slightly off if you have modified the dfire.cgi script.
4] Below that line please add the following two lines:
$AOK = '-a-zA-Z0-9_.+:/';
$command =~ s/[^$AOK]/ /go;
5] Verify that the new Dragon-Fire works by performing a few queries
Solution:
NSW issued an immediate fix to its user community via a customer security bulletin. The fix instructions here are taken from this bulletin.
If you have Dragon-Fire exposed to the Internet, please modify it
now and take the steps outlined here to patch it.
1] Open dfire.cgi with vi.
2] Goto to line 215 with a ':215' command
3] The line should read:
$command = $command . '-f ' . $db . $input{'database'} .
'/dragon.db';
It may be slightly off if you have modified the dfire.cgi script.
4] Below that line please add the following two lines:
$AOK = '-a-zA-Z0-9_.+:/';
$command =~ s/[^$AOK]/ /go;
5] Verify that the new Dragon-Fire works by performing a few queries