Symantec Sygate Management Server Input Validation Error Lets Remote Users Inject SQL Commands to Gain Administrative Access
|
|
SecurityTracker Alert ID: 1015561
|
|
SecurityTracker URL: http://securitytracker.com/id?1015561
|
|
CVE Reference: CVE-2006-0522
(Links to External Site)
|
Updated: Feb 8 2006
|
Original Entry Date: Feb 1 2006
|
Impact: Disclosure of system information, Disclosure of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Symantec Advisory
|
Version(s): 4.1 build 1417 and prior versions
|
Description: A vulnerability was reported in Symantec's Sygate Management Server (SMS). A remote user can inject SQL commands to gain administrative access to the application.
The software does not properly validate user-supplied input. A remote user can supply a specially crafted parameter value to execute
SQL commands on the underlying database. This can be exploited to overwrite the password for any SMS account, including the SMS
administrator account. Then, the remote user can use the new password to gain access to the SMS console with full administrator
privileges. With full administrator privileges, the remote user can, for example, disable all agents or propagate malware to all
managed agents.
The vendor credits Guillaume Goutaudier and Nicolas Gregoire at Exaprobe, SAS, France with reporting this vulnerability.
|
Impact: A remote user can execute SQL commands on the underlying database. This can be exploited to gain administrative access on the application.
|
Solution: The vendor has issued a fix.
SMS (English version) 3.5 MR 3 build 894 or earlier:
ftp://SMS35b895@207.33.111.31
SMS (English
version) 4.0 MR 1 build 1104 and earlier:
ftp://SMS40B1105@207.33.111.31
SMS (English version) 4.1 MR 2 build 1417 and earlier:
ftp://SSE41MR2@207.33.111.31
S
MS 4.1 (Chinese Version) 4.1 MR1 build 1351 and earlier:
ftp://SMS1352c@207.33.111.31
For password access, contact technical
support.
For SMS 4.1 GA (Japanese Version) build 1258 and earlier, contact technical support.
The vendor's advisory is available
at:
http://securityresponse.symantec.com/avcenter/security/Content/2006.02.01.html
|
Vendor URL: securityresponse.symantec.com/avcenter/security/Content/2006.02.01.html (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (2000), Windows (2003)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 1 Feb 2006 12:04:59 -0500
Subject: Symantec Sygate Management Server: SMS Authentication Servlet SQL Injection
|
http://securityresponse.symantec.com/avcenter/security/Content/2006.02.01.html
|
|
