Air Messenger LAN Server Discloses Usernames and Passwords and any File on the Server to Remote Users
|
Date: Jun 18 2001 20:55 (UTC/GMT)
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Advisory: SNS Research
|
Version(s): This was tested against AMLServer 3.4.2 on Windows 2000
|
Description: SNS Research reported that there are multiple vulnerabilities in the Air Messenger LAN Server, a Windows-based paging server. The
server allows remote users to view any document on the server, including a file that contains the paging server's usernames and
passwords in plaintext form.
The server's "Webpaging" http interface is reportedly susceptible to a directory traversal attack. If a remote user adds the string
"../" to a URL, the remote user can access files that reside outside of the webserver's publishing directory.
The server also
reportedly stores all username and password information in plaintext in the file pUser.Dat, which is located in the server's main
directory.
The exact location of the pUser.Dat file can reportedly be determined by a remote user by exploiting another vulnerability.
The http-header 'Location' field apparently contains the full path to servermaindir/Messages directory.
|
Impact: A remote user can obtain any file on the drive that the server is installed on. A remote user can determine the location of the
password file for the paging server and can obtain the file, which contains usernames and passwords in plaintext (unencrypted) form.
|
Solution: No solution was available at the time of this entry. However, the vendor reportedly plans to correct the problem in version 4.
|
Vendor URL: www.internetsoftwaresolutions.org/products/amlserver/index.html (Links to External Site)
|
Cause: Access control error, Authentication error, Input validation error
|
Underlying OS: Windows (Me), Windows (NT), Windows (95), Windows (98), Windows (2000)
|
Reported By: SNS Research <vuln-dev@greyhack.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 18 Jun 2001 16:36:56 -0400
From: SNS Research <vuln-dev@greyhack.com>
Subject: Multiple Vulnerabilities In AMLServer
|
Strumpf Noir Society Advisories
! Public release !
<--#
-= Multiple Vulnerabilities In AMLServer =-
Release date: Monday, June 18, 2001
Introduction:
Air Messenger LAN Server is a paging gateway server for MS Windows
that allows you to send and recieve messages to a paging network
over a TCP/IP LAN to phones, pagers and e-mail.
AMLServer is available from vendor Internet Software Solutions's
website: http://www.internetsoftwaresolutions.org
Problem(s):
AMLServer Directory Traversal Problem
AMLServer's "Webpaging" http interface is susceptible to a directory
traversal attack. Adding the string "../" to a URL allows an
attacker access to files outside of the webserver's publishing
directory. This allows read access to any file on the server.
AMLServer Plaintext Password Storage
A second problem is found in the file pUser.Dat. All
username/password combinations applicable to the various services
provided by AMLServer are stored in this file in plaintext.
AMLServer Path Disclosure
The mentioned userfile is stored in the server's main directory.
The exact location can be obtained exploiting another problem in
the web interface, a path disclosure bug. The http-header field
'Location' contains the full path to servermaindir/Messages.
For example:
$ telnet target 80|grep Location
Location: http://C:\PROGRA~1\ISS\AIRMES~1\Messages
Connection closed by foreign host.
(..)
Solution:
Vendor has been notified and has expressed the intention to fix
these problems in version 4. Unfortunately, at the time of this
advisory the vendor wasn't able to supply us with an approximate
date for this "fixed" release so we have not been able to verify
this.
This was tested against AMLServer 3.4.2 on Win2k.
yadayadayada
Free sk8! (http://www.freesk8.org)
SNS Research is rfpolicy (http://www.wiretrip.net/rfp/policy.html)
compliant, all information is provided on AS IS basis.
EOF, but Strumpf Noir Society will return!
|
|
