IP3 NetAccess < - Remote Arbitrary File Disclosure Vulnerability

ID EDB-ID:3294
Type exploitdb
Reporter Sebastian Wolfgarten
Modified 2007-02-11T00:00:00


IP3 NetAccess < Remote Arbitrary File Disclosure Vulnerability. CVE-2007-0883. Remote exploit for hardware platform

                                            I - TITLE

Security advisory: Arbitrary file disclosure vulnerability in
                   IP3 NetAccess leads to full system compromise


Description: Arbitrary file disclosure vulnerability in IP3 NetAccess
             leads to full system compromise

Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com)

Date: February 11th, 2007

Severity: High

References: http://www.devtarget.org/ip3-advisory-02-2007.txt


IP3's NetAccess is a device created for high demand environments 
such as convention centers or hotels. It handles the Internet access 
and provides for instance firewalling, billing, rate-limiting as well
as various authentication mechanisms. The device is administrated via
SSH or a web-based GUI. Further information about the product can be
found online at http://www.ip3.com/poverview.htm.


Due to inproper input validation, all NetAccess devices with a firmware version
less than are vulnerable to an arbitrary file disclosure vulnerability.
This vulnerability allows an unauthenticated remote attacker to abuse the
web interface and read any file on the remote system. Due to the fact that important
system files are world-readable (see bid #17698), this does include /etc/shadow
and thus leads to a full compromise of the device! In addition an attacker is
able to gain access to the proprietary code base of the device and potentially
identify as well as exploit other (yet unknown) vulnerabilities.


The trivial vulnerability can be exploited by accessing the file "getfile.cgi"
with a relative file path such as


As the input to the "filename" parameter is not properly validated accessing
this URL will disclose the contents of /etc/shadow to a remote attacker.


To address this problem, the vendor has released a new firmware version
( which is available at http://www.ip3.com. Hence all users of IP3's NetAccess
devices are asked to install this version immediately.

As a temporary workaround, one may also limit the accessibility of the web interface
of the device to authorized personnel only. Nevertheless contacting the vendor and
installing the new firmware version is highly recommended!


31. December 2006 - Notified vendor
31. December 2006 - Vulnerability confirmed
17. January 2007 - Patch released
11. February 2007 - Public disclosure

# milw0rm.com [2007-02-11]