(Vendor Issues Fix) Bottomline WebSeries Discloses Information to Remote Authenticated Users and Lets Users Bypass Password Policy
SecurityTracker Alert ID: 1013072|
SecurityTracker URL: http://securitytracker.com/id/1013072
(Links to External Site)
Date: Feb 3 2005
Disclosure of authentication information, Disclosure of system information, Disclosure of user information|
Fix Available: Yes Vendor Confirmed: Yes |
Several vulnerabilities were reported in WebSeries. A remote authenticated can determine the installation path and directory structure and can run arbitrary reports in certain cases. A user can also bypass password policy.|
Portcullis reported that several internal variables contained within HTML web pages on the application disclose the installation path to remote authenticated users.
A remote authenticated user can modify variables provided to 'BTInteractiveViewer.asp' during report selection to determine part of the directory structure on the target system. If the user-supplied 'ReportName' contains a filename that exists in the user-supplied 'ReportPath' filepath, the system will indicate:
Unable to load report
If the filename does not exist in that filepath, the system will indicate:
The system cannot find the file specified
If the filepath (directory) does not exist, the system will indicate:
The system cannot find the path specified
A remote authenticated user can modify their password without having to re-enter the original password.
A remote authenticated user can modify certain parameters when selecting a report to cause the application to download and execute arbitrary reports from any system on the network that supports Windows shares. It may be possible to execute a report that displays sensitive information, such as usernames and passwords.
A remote authenticated can determine the installation path and directory structure on the target system.|
A remote user can run arbitrary reports in certain cases.
A user can also bypass password policy.
The vendor has issued a fix for the password changing vulnerability via an enhancement to the WebSeries v4.0 product. For more information about the fix, contact Bottomline at:|
+44 (0)1189 258253
For the client-based password policy vulnerability, the vendor indicates that this is a low priority, conceptual threat only and as such may be addressed as an enhancement in later releases of the product.
For the report file enumeration flaw, the report command execution flaw, and the HTTP variable path disclosure flaw, the vendor indicates that a service pack will be released in Q1 2005.
Vendor URL: www.bottomline.co.uk/bacstel-ip/webseries.htm (Links to External Site)
Access control error|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Subject: Portcullis Advisory 05-008 Update, Webseries Payment Application|
Portcullis Security Advisory
AREAS UPDATED: VENDOR RESPONSE.
The product vendor, Bottomline Technologies has provided Portcullis with
the following response to the security advisory. It should be noted that
the resolution of this issue has not been verified by Portcullis:
Bottomline have addressed this issue via an enhancement to the WebSeries
Contact Bottomline at: firstname.lastname@example.org Tel: +44 (0)1189
Webseries Payment Application
Poor Password Change Implementation
Vulnerability discovery and development:
Portcullis Security Testing Services
Bottomline Webseries Payment Application
The change password functionality does not require a user to enter their
>From a system with a valid user logged in it is a trivial matter for a
user to change the password of a valid user and gain full access to the
No exploit code required
Copyright (c) Portcullis Computer Security Limited 2005, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information
The information in this email is confidential and may be
legally privileged. It is intended solely for the addressee.
Any opinions expressed are those of the individual and do not
represent the opinion of the organisation.
Access to this email by persons other than the intended
recipient is strictly prohibited.
If you are not the intended recipient, any disclosure, copying,
distribution or other action taken or omitted to be taken in
reliance on it, is prohibited and may be unlawful.
When addressed to our clients any opinions or advice contained
in this email is subject to the terms and conditions expressed
in the applicable Portcullis Computer Security Limited terms