Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Symantec Firewall/VPN Appliance Displays Password When Edited
|
|
SecurityTracker Alert ID: 1009069
|
|
CVE Reference: CAN-2004-0190
(Links to External Site)
|
Updated: Mar 4 2004
|
Original Entry Date: Feb 16 2004
|
Impact: Disclosure of authentication information
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): Model 200
|
Description: A vulnerability was reported in the Symantec Firewall/VPN Appliance. A user may be able to obtain the administrator's password.
Davide Del Vecchio reported that when an administrator edits the password via the password administration page, the password is displayed
in clear text. Because of this, the password will reportedly be cached by the administrator's web browser.
A local user on the
administrator's computer may be able to access the password. A physically local user may be able to view the password when edited
by an authenticated administrator. In addition, the report indicates that a remote user may be able to send malicious HTML to the
target administrator to invoke the cached password.
[Editor's note: The remote administration is via non-secure HTTP, as indicated
in the report, which creates a separate vulnerability. However, we have not issued an Alert regarding the use of non-secure HTTP,
as an HTTP administration feature would create no expectations of secure password transmission.]
|
Impact: A local user on the administrator's computer may be able to access the password.
A physically local user may be able to view the password when edited by an authenticated administrator.
|
Solution: No solution was available at the time of this entry.
The vendor has reportedly indicated that the observed behavior is by design and is not a bug.
|
Vendor URL: enterprisesecurity.symantec.com/products/products.cfm?ProductID=63&EID=0 (Links to External Site)
|
Cause: Access control error
|
Reported By: "Davide Del Vecchio" <dante@alighieri.org>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 16 Feb 2004 08:55:17 +0100
From: "Davide Del Vecchio" <dante@alighieri.org>
Subject: [Full-Disclosure] Symantec FireWall/VPN Appliance model 200 leak of security
|
============================================================
Symantec FireWall/VPN Appliance model 200 leak of security
============================================================
Davide Del Vecchio Adv#9
Discovered in: 15/01/2004
Date: 15/02/2004
Tested on FireWall/VPN Applicance model 200
Vendor notified.
Description of the Appliance:
The FireWall/VPN Appliance 200 is an integrated security and
networking device that provides easy secure, and cost-effective
Internet connectivity between locations. With its all-in-one
functionality, small businesses and remote offices can create
a high-speed local network that enables secure access and
interaction via the Internet with remote locations, business
partners, and corporate networks.
The problem:
Editing the password administration page, the password is in
clear text. To access the administration page, you have to
insert the admin psw, but your password will be cached in your
pc and in every proxy server. It makes the Appliance NOT usefull
to be managed remotely.
Solution:
Contacted the Symantec Enterprise Support, they told me the "feature"
is "by design", because of the HTTP connection instead of HTTPS, so
it was NOT a bug (even if they did not know about it).
My only statement was "adding vulns to vulns.. what about a java script?"
Credits:
Davide Del Vecchio would like to thank all the people supporting him
and his research, Diego Fuggetta, Gianluca Bellantuono, Filippo Sismondo,
Carlo Martini, Giorgio Vitelli, Davide Zanella, his special sad friend
Marcello Barnaba, finally but in primis his love that never leaves him
alone.
Happy Birthday to me.
Disclaimer:
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
^^^^^^^^
Please send suggestions, updates, and comments to:
Davide Del Vecchio , Dante Alighieri - dante at alighieri dot org
http://www.alighieri.org
--
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Davide Del Vecchio "Dante Alighieri" dante (at) alighieri (dot) org
http://www.alighieri.org http://www.bluejack.it http://www.ezln.it
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
Go to the Top of This SecurityTracker Archive Page
|
