Snare Agent Linux Password Disclosure / CSRF Vulnerabilities

2012-12-12T00:00:00
ID 1337DAY-ID-19941
Type zdt
Reporter Andrew Brooks
Modified 2012-12-12T00:00:00

Description

Snare for Linux ships with a web interface that can be used for viewing log data and configuring the agent. In the web interface at /remote, a user is able to set a password for remote configuration of the agent. The rendered page contains the field "RemotePassword" with its input type set to password which masks the password in the interface, however this is purely aesthetic. By inspecting the page source and examining the RemotePassword field, it is possible to retrieve the MD5 hash of the current password. Versions prior to 1.7.0 are affected. Snare for Linux suffers from a cross site request forgery vulnerability due to a poor implementation of the ChToken. All versions prior to 1.7.0 are vulnerable.

                                        
                                            Snare for Linux Password Disclosure


I. BACKGROUND
----------------------
Snare for Linux provides a 'C2' or 'CAPP' style audit 
subsystem for the Linux operating system. It can be
used as a standalone auditing tool for Linux, or can 
send data to the Snare Server for analysis and storage. 


II. DESCRIPTION
----------------------
Snare for Linux ships with a web interface that can be
used for viewing log data and configuring the agent.  In
the web interface at /remote, a user is able to set a password
for remote configuration of the agent.  The rendered page 
contains the field "RemotePassword" with its input type set
to password which masks the password in the interface, however
this is purely aesthetic.  By inspecting the page source and
examining the RemotePassword field, it is possible to retrieve
the MD5 hash of the current password.


III. AFFECTED PRODUCTS
----------------------
All versions of Snare for Linux prior to 1.7.0 are vulnerable.


IV.
----------------------
Users should upgrade to version 1.7.0 of Snare for Linux.


V. Credit
----------------------
This vulnerability was discovered by Andrew Brooks.


VI. References
----------------------
CVE-2011-5247
http://rpmfind.net/linux/RPM/sourceforge/s/sn/snare/Snare%20for%20Linux/1.7.0/SnareLinux-1.7.0-0.i386.html


VII. Timeline
----------------------
7/11/11 - Vendor notification
8/09/11 - Fixed and closed

-----------------------------------------------------------------------

Snare for Linux Cross-Site Request Forgery


I. BACKGROUND
----------------------
Snare for Linux provides a 'C2' or 'CAPP' style audit 
subsystem for the Linux operating system. It can be
used as a standalone auditing tool for Linux, or can 
send data to the Snare Server for analysis and storage. 


II. DESCRIPTION
----------------------
A cross-site request forgery vulnerability (CSRF) has 
been identified in the web interface of Snare for Linux.
The parameter "ChToken," which is designed to prevent
CSRF, was not properly implemented in versions prior
to 1.7.0.  As a result, an attacker could force an
authenticated user to execute unwanted actions on the
web interface.


III. AFFECTED PRODUCTS
----------------------
All versions of Snare for Linux prior to 1.7.0 are vulnerable.


IV.
----------------------
Users should upgrade to version 1.7.0 of Snare for Linux.


V. Credit
----------------------
This vulnerability was discovered by Andrew Brooks.


VI. References
----------------------
CVE-2011-5250
http://rpmfind.net/linux/RPM/sourceforge/s/sn/snare/Snare%20for%20Linux/1.7.0/SnareLinux-1.7.0-0.i386.html


VII. Timeline
----------------------
7/11/11 - Vendor notification
8/09/11 - Fixed and closed

#  0day.today [2018-03-14]  #