66 lines
No EOL
2.5 KiB
Text
66 lines
No EOL
2.5 KiB
Text
I - TITLE
|
|
|
|
Security advisory: Arbitrary file disclosure vulnerability in
|
|
IP3 NetAccess leads to full system compromise
|
|
|
|
II - SUMMARY
|
|
|
|
Description: Arbitrary file disclosure vulnerability in IP3 NetAccess
|
|
leads to full system compromise
|
|
|
|
Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com)
|
|
|
|
Date: February 11th, 2007
|
|
|
|
Severity: High
|
|
|
|
References: http://www.devtarget.org/ip3-advisory-02-2007.txt
|
|
|
|
III - OVERVIEW
|
|
|
|
IP3's NetAccess is a device created for high demand environments
|
|
such as convention centers or hotels. It handles the Internet access
|
|
and provides for instance firewalling, billing, rate-limiting as well
|
|
as various authentication mechanisms. The device is administrated via
|
|
SSH or a web-based GUI. Further information about the product can be
|
|
found online at http://www.ip3.com/poverview.htm.
|
|
|
|
IV - DETAILS
|
|
|
|
Due to inproper input validation, all NetAccess devices with a firmware version
|
|
less than 4.1.9.6 are vulnerable to an arbitrary file disclosure vulnerability.
|
|
This vulnerability allows an unauthenticated remote attacker to abuse the
|
|
web interface and read any file on the remote system. Due to the fact that important
|
|
system files are world-readable (see bid #17698), this does include /etc/shadow
|
|
and thus leads to a full compromise of the device! In addition an attacker is
|
|
able to gain access to the proprietary code base of the device and potentially
|
|
identify as well as exploit other (yet unknown) vulnerabilities.
|
|
|
|
V - EXPLOIT CODE
|
|
|
|
The trivial vulnerability can be exploited by accessing the file "getfile.cgi"
|
|
with a relative file path such as
|
|
|
|
http://$target/portalgroups/portalgroups/getfile.cgi?filename=../../../../../../../../etc/shadow
|
|
|
|
As the input to the "filename" parameter is not properly validated accessing
|
|
this URL will disclose the contents of /etc/shadow to a remote attacker.
|
|
|
|
VI - WORKAROUND/FIX
|
|
|
|
To address this problem, the vendor has released a new firmware version
|
|
(4.1.9.6) which is available at http://www.ip3.com. Hence all users of IP3's NetAccess
|
|
devices are asked to install this version immediately.
|
|
|
|
As a temporary workaround, one may also limit the accessibility of the web interface
|
|
of the device to authorized personnel only. Nevertheless contacting the vendor and
|
|
installing the new firmware version is highly recommended!
|
|
|
|
VII - DISCLOSURE TIMELINE
|
|
|
|
31. December 2006 - Notified vendor
|
|
31. December 2006 - Vulnerability confirmed
|
|
17. January 2007 - Patch released
|
|
11. February 2007 - Public disclosure
|
|
|
|
# milw0rm.com [2007-02-11] |