IP3 NetAccess < 4.1.9.6 Remote Arbitrary File Disclosure Vulnerability

🗓️ 13 Feb 2007 00:00:00Reported by RootType

IP3 NetAccess < 4.1.9.6 Remote Arbitrary File Disclosure Vulnerability. High severity vulnerability allows remote attackers to read any file on the system, including /etc/shadow, potentially leading to full device compromise


                                                I&nbsp;-&nbsp;TITLE

Security&nbsp;advisory:&nbsp;Arbitrary&nbsp;file&nbsp;disclosure&nbsp;vulnerability&nbsp;in
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;IP3&nbsp;NetAccess&nbsp;leads&nbsp;to&nbsp;full&nbsp;system&nbsp;compromise

II&nbsp;-&nbsp;SUMMARY

Description:&nbsp;Arbitrary&nbsp;file&nbsp;disclosure&nbsp;vulnerability&nbsp;in&nbsp;IP3&nbsp;NetAccess
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;leads&nbsp;to&nbsp;full&nbsp;system&nbsp;compromise

Author:&nbsp;Sebastian&nbsp;Wolfgarten&nbsp;(sebastian&nbsp;at&nbsp;wolfgarten&nbsp;dot&nbsp;com)

Date:&nbsp;February&nbsp;11th,&nbsp;2007

Severity:&nbsp;High

References:&nbsp;http://www.devtarget.org/ip3-advisory-02-2007.txt

III&nbsp;-&nbsp;OVERVIEW

IP3\'s&nbsp;NetAccess&nbsp;is&nbsp;a&nbsp;device&nbsp;created&nbsp;for&nbsp;high&nbsp;demand&nbsp;environments&nbsp;
such&nbsp;as&nbsp;convention&nbsp;centers&nbsp;or&nbsp;hotels.&nbsp;It&nbsp;handles&nbsp;the&nbsp;Internet&nbsp;access&nbsp;
and&nbsp;provides&nbsp;for&nbsp;instance&nbsp;firewalling,&nbsp;billing,&nbsp;rate-limiting&nbsp;as&nbsp;well
as&nbsp;various&nbsp;authentication&nbsp;mechanisms.&nbsp;The&nbsp;device&nbsp;is&nbsp;administrated&nbsp;via
SSH&nbsp;or&nbsp;a&nbsp;web-based&nbsp;GUI.&nbsp;Further&nbsp;information&nbsp;about&nbsp;the&nbsp;product&nbsp;can&nbsp;be
found&nbsp;online&nbsp;at&nbsp;http://www.ip3.com/poverview.htm.

IV&nbsp;-&nbsp;DETAILS

Due&nbsp;to&nbsp;inproper&nbsp;input&nbsp;validation,&nbsp;all&nbsp;NetAccess&nbsp;devices&nbsp;with&nbsp;a&nbsp;firmware&nbsp;version
less&nbsp;than&nbsp;4.1.9.6&nbsp;are&nbsp;vulnerable&nbsp;to&nbsp;an&nbsp;arbitrary&nbsp;file&nbsp;disclosure&nbsp;vulnerability.
This&nbsp;vulnerability&nbsp;allows&nbsp;an&nbsp;unauthenticated&nbsp;remote&nbsp;attacker&nbsp;to&nbsp;abuse&nbsp;the
web&nbsp;interface&nbsp;and&nbsp;read&nbsp;any&nbsp;file&nbsp;on&nbsp;the&nbsp;remote&nbsp;system.&nbsp;Due&nbsp;to&nbsp;the&nbsp;fact&nbsp;that&nbsp;important
system&nbsp;files&nbsp;are&nbsp;world-readable&nbsp;(see&nbsp;bid&nbsp;#17698),&nbsp;this&nbsp;does&nbsp;include&nbsp;/etc/shadow
and&nbsp;thus&nbsp;leads&nbsp;to&nbsp;a&nbsp;full&nbsp;compromise&nbsp;of&nbsp;the&nbsp;device!&nbsp;In&nbsp;addition&nbsp;an&nbsp;attacker&nbsp;is
able&nbsp;to&nbsp;gain&nbsp;access&nbsp;to&nbsp;the&nbsp;proprietary&nbsp;code&nbsp;base&nbsp;of&nbsp;the&nbsp;device&nbsp;and&nbsp;potentially
identify&nbsp;as&nbsp;well&nbsp;as&nbsp;exploit&nbsp;other&nbsp;(yet&nbsp;unknown)&nbsp;vulnerabilities.

V&nbsp;-&nbsp;EXPLOIT&nbsp;CODE

The&nbsp;trivial&nbsp;vulnerability&nbsp;can&nbsp;be&nbsp;exploited&nbsp;by&nbsp;accessing&nbsp;the&nbsp;file&nbsp;\"getfile.cgi\"
with&nbsp;a&nbsp;relative&nbsp;file&nbsp;path&nbsp;such&nbsp;as

http://$target/portalgroups/portalgroups/getfile.cgi?filename=../../../../../../../../etc/shadow

As&nbsp;the&nbsp;input&nbsp;to&nbsp;the&nbsp;\"filename\"&nbsp;parameter&nbsp;is&nbsp;not&nbsp;properly&nbsp;validated&nbsp;accessing
this&nbsp;URL&nbsp;will&nbsp;disclose&nbsp;the&nbsp;contents&nbsp;of&nbsp;/etc/shadow&nbsp;to&nbsp;a&nbsp;remote&nbsp;attacker.

VI&nbsp;-&nbsp;WORKAROUND/FIX

To&nbsp;address&nbsp;this&nbsp;problem,&nbsp;the&nbsp;vendor&nbsp;has&nbsp;released&nbsp;a&nbsp;new&nbsp;firmware&nbsp;version
(4.1.9.6)&nbsp;which&nbsp;is&nbsp;available&nbsp;at&nbsp;http://www.ip3.com.&nbsp;Hence&nbsp;all&nbsp;users&nbsp;of&nbsp;IP3\'s&nbsp;NetAccess
devices&nbsp;are&nbsp;asked&nbsp;to&nbsp;install&nbsp;this&nbsp;version&nbsp;immediately.

As&nbsp;a&nbsp;temporary&nbsp;workaround,&nbsp;one&nbsp;may&nbsp;also&nbsp;limit&nbsp;the&nbsp;accessibility&nbsp;of&nbsp;the&nbsp;web&nbsp;interface
of&nbsp;the&nbsp;device&nbsp;to&nbsp;authorized&nbsp;personnel&nbsp;only.&nbsp;Nevertheless&nbsp;contacting&nbsp;the&nbsp;vendor&nbsp;and
installing&nbsp;the&nbsp;new&nbsp;firmware&nbsp;version&nbsp;is&nbsp;highly&nbsp;recommended!

VII&nbsp;-&nbsp;DISCLOSURE&nbsp;TIMELINE

31.&nbsp;December&nbsp;2006&nbsp;-&nbsp;Notified&nbsp;vendor
31.&nbsp;December&nbsp;2006&nbsp;-&nbsp;Vulnerability&nbsp;confirmed
17.&nbsp;January&nbsp;2007&nbsp;-&nbsp;Patch&nbsp;released
11.&nbsp;February&nbsp;2007&nbsp;-&nbsp;Public&nbsp;disclosure

&nbsp;

13 Feb 2007 00:00Current

7.1High risk

Vulners AI Score7.1