91 lines
No EOL
3.2 KiB
Text
91 lines
No EOL
3.2 KiB
Text
Title: WIN-911 - Insecure File Permissions EoP
|
|
CWE Class: CWE-276: Incorrect Default Permissions
|
|
Date: 05/09/2016
|
|
Vendor: Win911
|
|
Product: WIN-911
|
|
Type: Alarm Notification Software
|
|
Version: V7.17.00
|
|
Download URL: through Rockwell Automation downloads:
|
|
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?crumb=112
|
|
Filter on "win-911", "software", "all families"
|
|
Tested on: Windows 7x86 EN
|
|
Release mode: no bugbounty program, public release
|
|
|
|
- 1. Product Description: -
|
|
The most widely used alarm notification software for the automation industry.
|
|
WIN-911 is used by hundreds of Fortune 500 and Global 500 companies.
|
|
|
|
- 2. Technical Details/PoC: -
|
|
This vulnerability allows attackers to escalate their privilege to system administrator
|
|
or SYSTEM on vulnerable installations of Win-911.
|
|
An attacker must have a valid user-account on the system.
|
|
|
|
PoC 1:
|
|
The product is installed under "C:\Program Files\Specter Instruments\WIN-911 V7".
|
|
This directory allows EVERYONE to modify files within this location.
|
|
|
|
Besides executables running with administrative privileges there are also various services binaries.
|
|
These all run as SYSTEM and might be overwritten to obtain SYSTEM level access:
|
|
|
|
C:\Program Files\Specter Instruments\WIN-911 V7\Mobile-911 Bridge Inbound.exe
|
|
C:\Program Files\Specter Instruments\WIN-911 V7\Mobile-911 Bridge Outbound.exe
|
|
C:\Program Files\Specter Instruments\WIN-911 V7\viewLinc Bridge.exe
|
|
|
|
PoC 2:
|
|
The web-server is installed as a separate component under:
|
|
"C:\Program Files\Specter Instruments\WEB-911 Services"
|
|
This directory allows EVERYONE full-control.
|
|
Once exploited, this could affect remote users connecting to the web-server.
|
|
|
|
- 3. Mitigation: -
|
|
None.
|
|
If you are brave, edit the permissions.
|
|
Not sure how this impacts the application.
|
|
|
|
- 4. Author: -
|
|
sh4d0wman
|
|
|
|
|
|
################################################################
|
|
|
|
|
|
Title: WIN-911 - Credential Disclosure
|
|
CWE Class: CWE-276: Incorrect Default Permissions | CWE-256: Plaintext Storage of a Password
|
|
Date: 05/09/2016
|
|
Vendor: Win911
|
|
Product: WIN-911
|
|
Type: Alarm Notification Software
|
|
Version: V7.17.00
|
|
Download URL: through Rockwell Automation downloads:
|
|
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?crumb=112
|
|
Filter on "win-911", "software", "all families"
|
|
Tested on: Windows 7x86 EN
|
|
Release mode: no bugbounty program, public release
|
|
|
|
- 1. Product Description: -
|
|
The most widely used alarm notification software for the automation industry.
|
|
WIN-911 is used by hundreds of Fortune 500 and Global 500 companies.
|
|
|
|
- 2. Technical Details/PoC: -
|
|
This vulnerability allows attackers to obtain certain usernames and passwords on
|
|
vulnerable installations of Win-911.
|
|
An attacker must have a valid user-account on the system.
|
|
|
|
The product is installed under "C:\Program Files\Specter Instruments\WIN-911 V7".
|
|
This directory allows EVERYONE to read and modify files within this location.
|
|
|
|
During configuration an .ini file is populated with information.
|
|
Some of this information is sensitive.
|
|
|
|
The following settings will log credentials in plain-text:
|
|
FIX Remote Alarm
|
|
ArchestrA Direct Connect
|
|
viewLinc Direct Connect
|
|
WIN911 Pager
|
|
E-mail POP and SMTP
|
|
|
|
- 3. Mitigation: -
|
|
None yet.
|
|
|
|
- 4. Author: -
|
|
sh4d0wman |