PowerChute Network Shutdown Uses a Non-Secure Web Interface
|
|
SecurityTracker Alert ID: 1015250
|
|
SecurityTracker URL: http://securitytracker.com/id?1015250
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 22 2005
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Description: A vulnerability was reported in PowerChute Network Shutdown. The product uses a non-secure web interface.
The web interface only supports the HTTP protocol, which is not secure. A remote user with the ability to monitor the network between
the administrator and the web service can obtain the administrative password and can obtain all transmitted data.
The web interface
also permits an unlimited number of login attempts without enforcing a lockout period and without logging the attempts.
All versions
of PowerChute Network Shutdown are affected.
The vendor credits James Gaffney with reporting this vulnerability.
|
Impact: A remote user with the ability to monitor the network may be able to obtain the administrative password by monitoring plain text network communications.
|
Solution: No solution was available at the time of this entry. However, the vendor has provided the following workarounds [quoted]:
1.
Only log into PowerChute Network Shutdown from
http://localhost:3052.
Use a browser on the same server that PowerChute Network
Shutdown is
running to access the web interface. This prevents any traffic from
being transmitted onto the network and eliminates
the potential for
password snooping.
2. Enable a local server firewall rule to block any remote access to
TCP port 3052.
This
can be used in conjunction with number one to prevent the
possibility of any remote user accessing PowerChute Network Shutdown.
3.
Disable the web interface.
Disabling the Web Interface prevents any user from accessing the web
interface from anywhere. However,
since the web interface of
PowerChute Network Shutdown is the only way to view status and logs
and make configuration changes,
APC does not recommend this option.
Search APC's Knowledge Base for this advisory to view instructions
on how to disable the PowerChute
Network Shutdown web interface.
|
Vendor URL: nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=7330 (Links to External Site)
|
Cause: Access control error
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 21 Nov 2005 21:12:57 -0500
Subject: APC Security Advisory - PowerChute Network Shutdown's Web Interface Only Supports HTTP
|
http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=7330
|
|
