WebTrends Enterprise Reporting Server Multiple Vulnerabilities
BID:698
Info
WebTrends Enterprise Reporting Server Multiple Vulnerabilities
| Bugtraq ID: | 698 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Oct 09 1999 12:00AM |
| Updated: | Oct 09 1999 12:00AM |
| Credit: | This series of vulnerabilities were posted to the Bugtraq mailing list by Manos Megagiannis <[email protected]> on Sat, 9 Oct 1999. |
| Vulnerable: |
WebTrends WebTrends Enterprise Reporting Server 1.5 |
| Not Vulnerable: | |
Discussion
WebTrends Enterprise Reporting Server Multiple Vulnerabilities
Certain versions of the WebTrends Enterprise Reporting Server contain a series of vulnerabilities.
Namely versions 1.5 and previous, the vulnerabilities in question are:
1. Logging via the server will write to a world/writable file.
Under certain conditions this file may contain certain sensitive information such as usernames and passwords, in clear text. This in particular is known to occur if you are not running using PAM (Pluggable Authentication Module).
If the server is running without PAM, users must use the server provided interface to create new users and set their passwords. In this case, by default, everything (including username and password) is stored in clear text in the file "interface.log" with read/write permissions for user, group and other. Any local user can read that file. If a WebTrends user has also an shell account on the box with the same password, that account can be compromised.
2. The server stores its' user information in files with world read/write permissions.
All user information is stored in the directory "wtm_wtx/datfiles/users" in the format "username.usr". Those files are with owner/group/other read/write permissions. Any local user, can decrypt the password or even easier alter/delete the user file and therefore create a denial of service.
3. User profiles are stored in world readable, writable files.
By altering these files it may be possible to launch a denial of service attack. As with the user files all profile information is stored in "wtm_wtx/datfiles/profiles" with owner/group/other read/write permissions. Any local user can alter/delete the profile file and therefore create a denial of service.
4. Under default installations, a blank username and password is enabled. This will allow remote users to access the server with administration privileges to the software if the owner neglects to change this.
Certain versions of the WebTrends Enterprise Reporting Server contain a series of vulnerabilities.
Namely versions 1.5 and previous, the vulnerabilities in question are:
1. Logging via the server will write to a world/writable file.
Under certain conditions this file may contain certain sensitive information such as usernames and passwords, in clear text. This in particular is known to occur if you are not running using PAM (Pluggable Authentication Module).
If the server is running without PAM, users must use the server provided interface to create new users and set their passwords. In this case, by default, everything (including username and password) is stored in clear text in the file "interface.log" with read/write permissions for user, group and other. Any local user can read that file. If a WebTrends user has also an shell account on the box with the same password, that account can be compromised.
2. The server stores its' user information in files with world read/write permissions.
All user information is stored in the directory "wtm_wtx/datfiles/users" in the format "username.usr". Those files are with owner/group/other read/write permissions. Any local user, can decrypt the password or even easier alter/delete the user file and therefore create a denial of service.
3. User profiles are stored in world readable, writable files.
By altering these files it may be possible to launch a denial of service attack. As with the user files all profile information is stored in "wtm_wtx/datfiles/profiles" with owner/group/other read/write permissions. Any local user can alter/delete the profile file and therefore create a denial of service.
4. Under default installations, a blank username and password is enabled. This will allow remote users to access the server with administration privileges to the software if the owner neglects to change this.
Exploit / POC
WebTrends Enterprise Reporting Server Multiple Vulnerabilities
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
However, given the details of these vulnerabilities it seems that no pre-canned scripts would be needed. Simple hand editing of files would be enough.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
However, given the details of these vulnerabilities it seems that no pre-canned scripts would be needed. Simple hand editing of files would be enough.
Solution / Fix
WebTrends Enterprise Reporting Server Multiple Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
As a work around, you may wish to correct some of the permission problems by setting the files as only readable and writable by the UID under which the program itself runs.
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
As a work around, you may wish to correct some of the permission problems by setting the files as only readable and writable by the UID under which the program itself runs.