Twenty Year Anniversary

linbit.txt

linbit.txt
Posted Mar 30, 2004
Authored by Daniel Fabian | Site sec-consult.com

SEC-CONSULT Security Advisory - Linbit Linbox is vulnerable to authentication circumvention on its administration portal, password disclosure for all existing users, and using the obtained passwords, any account can be logged into via SSH.

tags | advisory
MD5 | 7492df126274009cc647dd21fc84d3ed

linbit.txt

Change Mirror Download


============================================================
SEC-CONSULT Security Advisory - LINBIT LINBOX
============================================================

Vendor: LINBIT Information Technologies GmbH (http://www.linbit.com)
Product: LINBOX
Vendor status: vendor contacted (22.01.2004)
Patch status: Patch available at http://linbox.linbit.at/

Vulnerabilites:

- Authentication circumvention for the administration portal
- Password disclosure for all existing users
- System login through SSH


============
Introduction
============

The LINBOX offers a comprehensive IT solution (internet gateway including
firewall, file server, mail server, proxy server etc.) to companies of any
size with a key priority on security.

Services/Features included in the LINBOX

* Central user administration (no LINUX skills required)
* Compatibility with Windows workstations
* Internet access (ISDN, ADSL, cable or leased line)
* Upon clients request provided with/without proxy server
* Integrated firewall to protect your company network
* Sophisticated internet access control (who is allowed to access the
internet via the proxy server)
* File server for your internal company data
* Print server for a central printer
* Uniform user settings at every workstation (domain controller)
* Simple adding or removing of Windows workstations (name server and
DHCP server)
* Central mail server. Manage e-mail accounts and mailing lists (e.g.
office@..., sales@...)
* Web e-mail to be used via the Internet throughout the world (e.g.
e-mail service during holidays or business trips)
* VPN access for field service or home working (via PPTP protocol)
* Virus scan for all e-mails and files (optional)

=====================
Vulnerability Details
=====================

1) AUTHENTICATION CIRCUMVENTION
===============================

DESCRIPTION:

LINBOX has a webbased administration portal on port 8080 that is accessible
through the internet by default. Opening this page in a browser gives the
user the following options:

- Administration
- Webmail
- Personal Settings

Hitting the link "Administration", the web application requests username and
password. The authentication mechanisms seems to be provided by a AuthMySQL
3.1 Apache module.

However because of a configuration fault, it is possible for an attacker to
bypass the authentication by opening the page //admin/user.pl (note the double
slash at the beginning), which gets the attacker to a list of users. Once on
that page, an attacker could as well just add a user of it's own (with
administration priviledges) and log in comfortably at the front page.

EXAMPLE:

---*---
Http-Request:
http://demo.linbox.at//admin/user.pl

---*---

REMARKS:

As soon as the attacker has an administrativ account, he can:
- Create/delete/change usrs
- Create/delete/change VPN accounts
- Change the network configuration (IP, default GW, etc.)
- Create/delete/change Samba shares as well as their permissions
- Shut the system down
- Deactivate the virus scanner


2) PASSWORD DISCLOSURE FOR ALL EXISTING USERS
=============================================

DESCRIPTION:

As soon as the attacker as access to the users.pl page (as described in 1),
he can read all passwords of all existing users by simply hitting the edit
button for each user. This page contains the password in an HTML password
input box, which the attacker can read in cleartext by viewing the source
code of the HTML page.


EXAMPLE:

<tr><td class="ADMIN-LEFT">Password:</td><td class="ADMIN-RIGHT"
colspan="1"><input type="password" name="adm_Password" value="dieter" />
***-----------------------------------------------------------^^^^^^
</td></tr>
<tr><td class="ADMIN-LEFT">Passwortbestätigung:</td><td class="ADMIN-RIGHT"
colspan="1"><input type="password" name="adm_Passwortbestätigung"
value="dieter" /> </td></tr>
***----^^^^^^


3) SYSTEM LOGIN THROUGH SSH
===========================

DESCRIPTION:

As all user accounts on the administrative portal are also system accounts,
an attacker can use a ssh-shell (if available) to login to the system with
the passwords provided in 2).

===============
GENERAL REMARKS
===============

Above findings derive from an external (black box) security test.
we would like to apologize in advance for potential nonconformities and/or
known issues.

====================
Recommended Hotfixes
====================

Patch:
Available from http://linbox.linbit.at/



EOF Daniel FABIAN / @2004
d.fabian@sec-cosult.com


SEC CONSULT Vienna GmbH

Blindengasse 3
A-1080 Wien
Austria / EUROPE

Tel.: +43 / 1 / 409 0307 - 570
Fax.: +43 / 1 / 409 0307 - 590
Mail: office@sec-consult.com
http://www.sec-consult.com

***************************************************************************
***************************************************************************
***************************************************************************


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    11 Files
  • 17
    Nov 17th
    1 Files
  • 18
    Nov 18th
    1 Files
  • 19
    Nov 19th
    3 Files
  • 20
    Nov 20th
    2 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close