exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Atstake Security Advisory 03-09-15.1

Atstake Security Advisory 03-09-15.1
Posted Sep 16, 2003
Authored by Atstake, Ollie Whitehouse | Site atstake.com

Atstake Security Advisory A091503-1 - The Nokia Electronic Documentation product has three vulnerabilities. A cross-site scripting vulnerability allows an attacker to run malicious code if javascript is enabled. A directory listing of the web root is available by supplying the underlying webserver with a period. NED can also be inadvertently used as an HTTP proxy server.

tags | advisory, web, root, javascript, vulnerability, xss
SHA-256 | 4924ba9b5946a4e3970ccd2e0126327f9de57382c0d428f532349345aa409bd4

Atstake Security Advisory 03-09-15.1

Change Mirror Download
Hash: SHA1

@stake, Inc.

Security Advisory

Advisory Name: Nokia Electronic Documentation - Multiple Vulnerabilities
Release Date: 09/15/2003
Application: NED (Nokia Electronic Documentation)
Platform: Windows NT4 and WebLogic tested (others may be
Severity: Information disclosure / cross-site scripting Open
Authors: Ollie Whitehouse <ollie@atstake.com>
Vendor Status: Informed / Statement Below
CVE Candidate: (pending) Multiple Nokia Electronic Documentation
Reference: www.atstake.com/research/advisories/2003/a091503-1.txt


Nokia (http://www.nokia.com) provides a web-based documentation
interface called NED for a number of it's cellular network products.

@stake have discovered three vulnerabilities in this product:
- Cross-site scripting
- Directory listing of certain directories under the web-root
- Being able to use NED as a proxy server for HTTP requests

Normally, NED deployments are within the OAM/O&M networks of the
cellular operator. However, as @stake discussed in the white paper
'GPRS Wireless Security: Not Ready for Prime Time'
reports/acrobat/atstake_gprs_security.pdf) these networks can be
exposed to risks which are not normally within the operators risk


The following examples are from a standard NED installation, which
in @stake's experience is upon NT4/IIS 3.0.

1) Cross-site scripting

A very simple cross-site scripting vulnerability exists. For
example, if an attacker makes the following request:


This will cause the malicious code to run in the attacker's browser
if Javascript is enabled.

2) Directory Listings

It is possible to cause the underlying application server
(WebLogic) to return a directory listing of the web-root. This is
achieved by simply supplying a '.' as the location to the NED
application. For example:


In addition, this will also return the physical path that NED
is installed on, which is by default:


3) Open Proxy

By specifying a location which contains the HTTP protocol URI, as
contained within the example URL below, one can cause NED to
retrieve the page in question and deliver the contents back. This
can potentially be used to launch attacks against hosts that the
NED server may have access to but the attacker does not (for
example in a DMZ deployment).


Vendor Response:

"Nokia has analyzed the three vulnerabilities in NED 5.0 that
@stake has discovered, and find them only to have consequences
under exceptional circumstances.

Exceptional circumstances meant here are potential intruders
(outsiders or own personnel) who have accessed the telecom
operators production/O&M network without authorization.

Telecom operators production networks and especially O&M networks
are isolated from other internal networks and public internet and
also operators own O&M personnel are considered to be trustworthy.
Thus Nokia will not provide any hot fixes (patches or workaround)
at this moment but will inform telecom operator customers about
the potential vulnerabilities and will remedy a defect in the next
NED 5.1 release upgrades at the beginning of the next year."


Look for the Nokia upgrades at the beginning of 2004. In addition,
operators should look to deploy additional network-based access
control around devices that have NED deployed on them.

Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

(pending) Multiple Nokia Electronic Documentation Issues

@stake Vulnerability Reporting Policy:

@stake Advisory Archive:

PGP Key:

Copyright 2003 @stake, Inc. All rights reserved.

Version: PGP 8.0


Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By