exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

SEC-20051212-0.txt

SEC-20051212-0.txt
Posted Dec 14, 2005
Site sec-consult.com

SEC-CONSULT Security Advisory 20051212-0 - Due to insufficient input validation within the Nortel SSL VPN appliance's web interface, it is possible for an attacker to supply his victim with a malicious link that results in code execution on the victim's client. The problem has been reproduced with version 4.2.1.6, however other versions might be vulnerable as well.

tags | advisory, web, code execution
SHA-256 | e737b6c4b673f2f6f1dbf7cd8019450391400b84e288a3d5d30d3947f18fc0a2

SEC-20051212-0.txt

Change Mirror Download
SEC-CONSULT Security Advisory 20051212-0
==========================================================================
title: Nortel SSL VPN Cross Site Scripting/Command
Execution
program: Nortel SSL VPN
vulnerable version: 4.2.1.6
homepage: www.nortel.com
found: 2005-05-30
by: Daniel Fabian / SEC-CONSULT / www.sec-consult.com
==========================================================================

Product Description:
---------------

The Nortel SSL VPN is a remote access security solution. By using secure
sockets layer (SSL) as the underlying security protocol, Nortel SSL VPN
allows for using the Internet for remote connectivity and the ubiquitous
Web browser as the primary client interface.


Vulnerabilty overview:
---------------

Due to insufficient input validation within the appliance's web interface,
it is possible for an attacker to supply his victim with a malicious link
that results in code execution on the victim's client. The problem has
been reproduced with version 4.2.1.6, however other versions might be
vulnerable as well.


Vulnerability details:
---------------

Due to insufficient input validation within the web interface of Nortel's
SSL VPN appliance, it is possible to hide commands in links to certain
pages of the web interface. As the Java Applet which is called from those
web pages is cryptographically signed, it may execute operating system
commands with the priviledges of the user sitting in front of the browser.

An attacker can thus supply his victim with a malicious link where
commands are hidden. If the victim clicks on the link and logs onto the
SSL VPN web interface (where it is automatically taken), arbitrary
commands are executed locally on the client of the victim.

Here is an example for a crafted link that executes the command "cmd.exe
/c echo test > c:\\test" (please consider the link one line):

---cut here---

https://SSL_VPN_SERVER/tunnelform.yaws?a=+cmd.exe+/c+echo+test+%3E+
c:\\test.txt+&type=Custom&sp=443&n=1&ph=&pp=&0tm=tcp&0lh=127.0.0.1&
0lp=8080&0hm=&0rh=10.10.10.10&0rp=80&sslEnabled=on&start=Start...

---cut here---


Vulnerable versions:
---------------

Nortel SSL VPN 4.2.1.6


Patch Status
---------------

According to vendor, a patch for this vulnerability has been incorporated
into maintainence release v5.1.5 of its VPN Gateway.


Vendor status:
---------------
vendor notified: 2005-05-30
vendor response: 2005-06-21
patch available: 2005-11-15
public disclos.: 2006-12-12


General remarks
---------------

We would like to apologize in advance for potential nonconformities and/or
known issues.

This advisory can also be found online at
http://www.sec-consult.com/247.html.

SEC Consult conducts periodical information security workshops on ISO
27001/BS 7799 in cooperation with BSI Management Systems. For more
information, please refer to http://www.sec-consult.com/236.html

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Blindengasse 3
A-1080 Wien
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 15
Mail: office at sec-consult dot com
www.sec-consult.com

EOF Daniel Fabian / @2005
d.fabian at sec-consult dot com




Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close