SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Commerce)  >   WebSeries Vendors:   Bottomline
(Vendor Issues Fix) Bottomline WebSeries Discloses Information to Remote Authenticated Users and Lets Users Bypass Password Policy
SecurityTracker Alert ID:  1013072
SecurityTracker URL:  http://securitytracker.com/id/1013072
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 3 2005
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Several vulnerabilities were reported in WebSeries. A remote authenticated can determine the installation path and directory structure and can run arbitrary reports in certain cases. A user can also bypass password policy.

Portcullis reported that several internal variables contained within HTML web pages on the application disclose the installation path to remote authenticated users.

A remote authenticated user can modify variables provided to 'BTInteractiveViewer.asp' during report selection to determine part of the directory structure on the target system. If the user-supplied 'ReportName' contains a filename that exists in the user-supplied 'ReportPath' filepath, the system will indicate:

Unable to load report

If the filename does not exist in that filepath, the system will indicate:

The system cannot find the file specified

If the filepath (directory) does not exist, the system will indicate:

The system cannot find the path specified

It is reported that the password policy (such as the minimum length of a password) is enforced via Javascript on the target user's system rather than on the server. As a result, a user can set their password to a length that is not permitted by the policy (e.g., a single-character password).

A remote authenticated user can modify their password without having to re-enter the original password.

A remote authenticated user can modify certain parameters when selecting a report to cause the application to download and execute arbitrary reports from any system on the network that supports Windows shares. It may be possible to execute a report that displays sensitive information, such as usernames and passwords.

Impact:   A remote authenticated can determine the installation path and directory structure on the target system.

A remote user can run arbitrary reports in certain cases.

A user can also bypass password policy.

Solution:   The vendor has issued a fix for the password changing vulnerability via an enhancement to the WebSeries v4.0 product. For more information about the fix, contact Bottomline at:

support@bottomline.co.uk
+44 (0)1189 258253

For the client-based password policy vulnerability, the vendor indicates that this is a low priority, conceptual threat only and as such may be addressed as an enhancement in later releases of the product.

For the report file enumeration flaw, the report command execution flaw, and the HTTP variable path disclosure flaw, the vendor indicates that a service pack will be released in Q1 2005.

Vendor URL:  www.bottomline.co.uk/bacstel-ip/webseries.htm (Links to External Site)
Cause:   Access control error

Message History:   This archive entry is a follow-up to the message listed below.
Jan 12 2005 Bottomline WebSeries Discloses Information to Remote Authenticated Users and Lets Users Bypass Password Policy



 Source Message Contents

Subject:  Portcullis Advisory 05-008 Update, Webseries Payment Application


Portcullis Security Advisory

AREAS UPDATED: VENDOR RESPONSE.

VENDOR RESPONSE:

The product vendor, Bottomline Technologies has provided Portcullis with
the following response to the security advisory. It should be noted that
the resolution of this issue has not been verified by Portcullis:

Bottomline have addressed this issue via an enhancement to the WebSeries
v4.0 product. 

Contact Bottomline at: support@bottomline.co.uk  Tel: +44 (0)1189
258253.
 
Vulnerable System: 
      
Webseries Payment Application
 
Vulnerability Title:  
 
Poor Password Change Implementation
 
Vulnerability discovery and development: 
 
Portcullis Security Testing Services
 
Affected systems: 
 
Bottomline Webseries Payment Application 
 
Details:
 
The change password functionality does not require a user to enter their
current password.
 
Impact:
 
>From a system with a valid user logged in it is a trivial matter for a
malicious 
user to change the password of a valid user and gain full access to the
account.
 
Exploit:
 
No exploit code required
 
Copyright: 
 
Copyright (c) Portcullis Computer Security Limited 2005, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.
 
Disclaimer: 
 
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information

*************************************************************
The information in this email is confidential and may be
legally privileged. It is intended solely for the addressee.
Any opinions expressed are those of the individual and do not
represent the opinion of the organisation. 
Access to this email by persons other than the intended
recipient is strictly prohibited.
If you are not the intended recipient, any disclosure, copying,
distribution or other action taken or omitted to be taken in
reliance on it, is prohibited and may be unlawful. 
When addressed to our clients any opinions or advice contained
in this email is subject to the terms and conditions expressed
in the applicable Portcullis Computer Security Limited terms
of business.
**************************************************************

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC