Sun AnswerBook2 1.4.2/1.4.3/1.4.4 Administration Interface Access

ID SSV:74033
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create administration accounts. By directly accessing the /cgi-bin/admin/admin script present under the AnswerBook2 dwhttpd web server, it is possible to add users to the administration interface. This will allow the attacker to read log files and manage content."