0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
IP3 NetAccess < 4.1.9.6 Remote Arbitrary File Disclosure Vulnerability
[======================================================================
IP3 NetAccess < 4.1.9.6 Remote Arbitrary File Disclosure Vulnerability
======================================================================
I - TITLE
Security advisory: Arbitrary file disclosure vulnerability in
IP3 NetAccess leads to full system compromise
II - SUMMARY
Description: Arbitrary file disclosure vulnerability in IP3 NetAccess
leads to full system compromise
Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com)
Date: February 11th, 2007
Severity: High
References: http://www.devtarget.org/ip3-advisory-02-2007.txt
III - OVERVIEW
IP3's NetAccess is a device created for high demand environments
such as convention centers or hotels. It handles the Internet access
and provides for instance firewalling, billing, rate-limiting as well
as various authentication mechanisms. The device is administrated via
SSH or a web-based GUI. Further information about the product can be
found online at http://www.ip3.com/poverview.htm.
IV - DETAILS
Due to inproper input validation, all NetAccess devices with a firmware version
less than 4.1.9.6 are vulnerable to an arbitrary file disclosure vulnerability.
This vulnerability allows an unauthenticated remote attacker to abuse the
web interface and read any file on the remote system. Due to the fact that important
system files are world-readable (see bid #17698), this does include /etc/shadow
and thus leads to a full compromise of the device! In addition an attacker is
able to gain access to the proprietary code base of the device and potentially
identify as well as exploit other (yet unknown) vulnerabilities.
V - EXPLOIT CODE
The trivial vulnerability can be exploited by accessing the file "getfile.cgi"
with a relative file path such as
http://$target/portalgroups/portalgroups/getfile.cgi?filename=../../../../../../../../etc/shadow
As the input to the "filename" parameter is not properly validated accessing
this URL will disclose the contents of /etc/shadow to a remote attacker.
VI - WORKAROUND/FIX
To address this problem, the vendor has released a new firmware version
(4.1.9.6) which is available at http://www.ip3.com. Hence all users of IP3's NetAccess
devices are asked to install this version immediately.
As a temporary workaround, one may also limit the accessibility of the web interface
of the device to authorized personnel only. Nevertheless contacting the vendor and
installing the new firmware version is highly recommended!
VII - DISCLOSURE TIMELINE
31. December 2006 - Notified vendor
31. December 2006 - Vulnerability confirmed
17. January 2007 - Patch released
11. February 2007 - Public disclosure
# 0day.today [2024-12-26] #