{"id": "SECURITYVULNS:DOC:15324", "bulletinFamily": "software", "title": "SYMSA-2006-012: 2X ThinClientServer Create Admin Account Replay Vulnerability", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n\r\n\r\n\r\n Symantec Vulnerability Research\r\n http://www.symantec.com/research\r\n Security Advisory\r\n\r\n\r\n Advisory ID: SYMSA-2006-012\r\nAdvisory Title: 2X ThinClientServer Create Admin Account Replay Vulnerability\r\n Author: Oliver Karow / oliver_karow@symantec.com\r\n Release Date: 12-04-2006\r\n Application: 2X ThinClientServer Enterprise Edition v3_sp2-r1865 \r\n Platform: Windows / Linux\r\n Severity: Remotely exploitable / Administrator Access\r\n Vendor status: Verified by vendor. Resolved in ThinClientServer 4.0.2248\r\n CVE Number: CVE-2006-6221\r\n Reference: http://www.securityfocus.com/bid/21300\r\n\r\n\r\nOverview:\r\n\r\n From vendor's website:\r\n\r\n"2X ThinClientServer provides a complete solution for the central\r\ndeployment, configuration and management of thin clients, and\r\nprovides load balancing and redundancy of terminal servers."\r\n\r\nIt is possible to create administrative user accounts for the application,\r\nwithout authentication.\r\n\r\n\r\n\r\nDetails:\r\n\r\n During the installation procedure, an administrative user account\r\nfor the application is created. Sending the same request with a different\r\nusername, after the installation is completed, creates an additional administrative\r\naccount. The account can be created remotely and authentication is not required.\r\n\r\n\r\n\r\nVendor Response:\r\n\r\nThe above vulnerability is fixed and applicable to the following versions:\r\n- - ThinClientServer 4.0\r\n Users of ThinClientServer Version 4 are unaffected by this issue.\r\n- - ThinClientServer 3.0\r\n Please Upgrade your machine to Version 4.0.2248 or higher and deploy\r\nthe new ThinClientOS 4.0 on your network to resolve this issue. This can be\r\ndone by uploading the new image zip file in the Management Console and setting\r\nit as the new default image for your ThinClients.\r\n\r\nCustomers who have prior versions of ThinClientServer are requested to upgrade\r\nto at least 4.0.2248 version.\r\n\r\n\r\n\r\nRecommendation:\r\n\r\n Upgrade to Version 4.0.2248 or higher to solve the issue.\r\n\r\n\r\nCommon Vulnerabilities and Exposures (CVE) Information:\r\n\r\nThe Common Vulnerabilities and Exposures (CVE) project has assigned\r\nthe following names to these issues. These are candidates for\r\ninclusion in the CVE list (http://cve.mitre.org), which standardizes\r\nnames for security problems.\r\n\r\n\r\n CVE-2006-6221\r\n\r\n- -------Symantec Vulnerability Research Advisory Information-------\r\n\r\nFor questions about this advisory, or to report an error:\r\nresearch@symantec.com\r\n\r\nFor details on Symantec's Vulnerability Reporting Policy: \r\nhttp://www.symantec.com/research/Symantec-Responsible-Disclosure.pdf\r\n\r\nSymantec Vulnerability Research Advisory Archive: \r\nhttp://www.symantec.com/research/ \r\n\r\nSymantec Vulnerability Research GPG Key:\r\nhttp://www.symantec.com/research/Symantec_Vulnerability_Research_GPG.asc\r\n\r\n- -------------Symantec Product Advisory Information-------------\r\n\r\nTo Report a Security Vulnerability in a Symantec Product:\r\nsecure@symantec.com \r\n\r\nFor general information on Symantec's Product Vulnerability \r\nreporting and response:\r\nhttp://www.symantec.com/security/\r\n\r\nSymantec Product Advisory Archive: \r\nhttp://www.symantec.com/avcenter/security/SymantecAdvisories.html\r\n\r\nSymantec Product Advisory PGP Key:\r\nhttp://www.symantec.com/security/Symantec-Vulnerability-Management-Key.asc\r\n\r\n- ---------------------------------------------------------------\r\n\r\nCopyright (c) 2006 by Symantec Corp.\r\nPermission to redistribute this alert electronically is granted \r\nas long as it is not edited in any way unless authorized by \r\nSymantec Consulting Services. Reprinting the whole or part of \r\nthis alert in any medium other than electronically requires \r\npermission from cs_advisories@symantec.com.\r\n\r\nDisclaimer\r\nThe information in the advisory is believed to be accurate at the \r\ntime of publishing based on currently available information. Use \r\nof the information constitutes acceptance for use in an AS IS \r\ncondition. There are no warranties with regard to this information. \r\nNeither the author nor the publisher accepts any liability for any \r\ndirect, indirect, or consequential loss or damage arising from use \r\nof, or reliance on, this information.\r\n\r\nSymantec, Symantec products, and Symantec Consulting Services are \r\nregistered trademarks of Symantec Corp. and/or affiliated companies \r\nin the United States and other countries. All other registered and \r\nunregistered trademarks represented in this document are the sole \r\nproperty of their respective companies/owners.\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.2.2 (GNU/Linux)\r\n\r\niD8DBQFFcD5Buk7IIFI45IARArUrAKCGC2b+xJOJHz+DaQeM23uRUW4bbwCeNxn6\r\nDY5D7fR4sT9uxoeLJtX7pl4=\r\n=Ngwq\r\n-----END PGP SIGNATURE-----", "published": "2006-12-07T00:00:00", "modified": "2006-12-07T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:15324", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2006-6221"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:20", "edition": 1, "viewCount": 1, "enchantments": {"score": {"value": 7.2, "vector": "NONE", "modified": "2018-08-31T11:10:20", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-6221"]}, {"type": "nessus", "idList": ["THINCLIENTSERVER_ADMIN_ACCT_CREATION.NASL"]}, {"type": "osvdb", "idList": ["OSVDB:31841"]}], "modified": "2018-08-31T11:10:20", "rev": 2}, "vulnersScore": 7.2}, "affectedSoftware": []}

{"cve": [{"lastseen": "2021-02-02T05:27:25", "description": "2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request.", "edition": 4, "cvss3": {}, "published": "2006-12-10T02:28:00", "title": "CVE-2006-6221", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-6221"], "modified": "2018-10-17T21:47:00", "cpe": ["cpe:/a:2x:thinclientserver:3.0"], "id": "CVE-2006-6221", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6221", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:2x:thinclientserver:3.0:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:20:28", "bulletinFamily": "software", "cvelist": ["CVE-2006-6221"], "description": "# No description provided by the source\n\n## References:\nSecurity Tracker: 1017350\n[Secunia Advisory ID:23248](https://secuniaresearch.flexerasoftware.com/advisories/23248/)\nOther Advisory URL: http://www.symantec.com/enterprise/research/SYMSA-2006-012.txt\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-12/0106.html\nISS X-Force ID: 30759\nFrSIRT Advisory: ADV-2006-4883\n[CVE-2006-6221](https://vulners.com/cve/CVE-2006-6221)\nBugtraq ID: 21300\n", "edition": 1, "modified": "2006-12-06T04:33:54", "published": "2006-12-06T04:33:54", "href": "https://vulners.com/osvdb/OSVDB:31841", "id": "OSVDB:31841", "title": "2X ThinClientServer Admin Account Replay Privilege Escalation", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-20T15:18:28", "description": "The remote host is running ThinClientServer, an application to convert\nexisting PCs into thin clients. \n\nThe version of ThinClientServer installed on the remote host allows an\nunauthenticated, remote attacker to create administrative accounts.", "edition": 23, "published": "2006-12-07T00:00:00", "title": "ThinClientServer Admin Account Creation Privilege Escalation", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-6221"], "modified": "2006-12-07T00:00:00", "cpe": [], "id": "THINCLIENTSERVER_ADMIN_ACCT_CREATION.NASL", "href": "https://www.tenable.com/plugins/nessus/23780", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(23780);\n script_version(\"1.16\");\n\n script_cve_id(\"CVE-2006-6221\");\n script_bugtraq_id(21300);\n\n script_name(english:\"ThinClientServer Admin Account Creation Privilege Escalation\");\n script_summary(english:\"Tries to create an account in ThinClientServer\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP script that allows creation of\nadditional administrative accounts.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running ThinClientServer, an application to convert\nexisting PCs into thin clients. \n\nThe version of ThinClientServer installed on the remote host allows an\nunauthenticated, remote attacker to create administrative accounts.\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9d0cb22c\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.securityfocus.com/advisories/11589\" );\n script_set_attribute(attribute:\"solution\", value:\n\"It is reported that upgrading to ThinClientServer version 4.0.2248 or\nhigher addresses this issue. You should also review the list of\nexisting administrators and remove any that are not valid.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2006/12/07\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2006/12/06\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_end_attributes();\n\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2006-2021 Tenable Network Security, Inc.\");\n\n script_dependencies(\"http_version.nasl\");\n script_require_ports(\"Services/www\", 943, 980);\n script_require_keys(\"www/PHP\");\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\n\nport = get_http_port(default:980);\nif (!can_host_php(port:port)) exit(0);\n\n\n# Check whether the script exists.\nurl = \"/enter.php?goto=%2F\";\nw = http_send_recv3(method:\"GET\", item:url, port:port);\nif (isnull(w)) exit(1, \"the web server did not answer\");\nres = w[2];\n\n\n# If ..\nif (\n # the script does exist and...\n \"<title>2X - Login\" >< res &&\n # we can't ostensibly create an account.\n \"name='dologin_new'\" >!< res\n)\n{\n # Try to exploit the flaw to generate another administrative user.\n user = string(\"nessus-\", rand_str());\n pass = rand();\n pass2 = string(\"not\", pass); # so we don't actually create the account.\n postdata = string(\n \"username=\", user, \"&\",\n \"password=\", pass, \"&\",\n \"re_password=\", pass2, \"&\",\n \"dologin_new=OK&\",\n \"dologin=true\"\n );\n w = http_send_recv3(method: \"POST\", item: url, port: port,\n content_type: \"application/x-www-form-urlencoded\",\n data: postdata );\n if (isnull(w)) exit(1, \"the web server did not answer\");\n\n # There's a problem if we get an error about passwords not matching.\n #\n # nb: in 4.0.2324, we just get \"Bad Username or Password\".\n if (\"Passwords don&#039;t match\" >< res) security_hole(port);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}