[NEWS] IBM Net.Data Internal Variables Display Vulnerability
From: support@securiteam.com
Date: 01/05/03
- Previous message: support@securiteam.com: "[NEWS] DB2 on iSeries Stored Procedures Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: 6 Jan 2003 00:11:02 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure,
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -
IBM Net.Data Internal Variables Display Vulnerability
------------------------------------------------------------------------
SUMMARY
Net.Data is a full-featured and easy to learn scripting language that
allows you to create powerful Web applications. A security vulnerability
in the product allows attackers to view internal variables values, which
may disclose sensitive information such as pathnames, server names,
usernames and passwords.
DETAILS
A HTML form that accepts user input, and displays this input back to the
user, can be maliciously exploited by typing in the form the variable
name.
Some variables are predefined in Net.Data, and potentially damaging.
$(DTW_CURRENT_FILENAME) always contains the internal script name and full
path.
If the database server is different from the application server, then
$(DATABASE) , $(LOGIN), and $(PASSWORD) must be defined and contain the
connection parameters.
If the Net.Data script displays back the information passed to it, and an
attacker passes the string $(LOGIN) as the form content, the resulting
HTML will display the connection profile.
Other predefined variables may be found at:
<http://www-3.ibm.com/software/data/net.data/docs/noframes/db2rn/index.htm> http://www-3.ibm.com/software/data/net.data/docs/noframes/db2rn/index.htm (Language Environment Variables and Miscellaneous Variables).
The problem is not limited to predefined variables. Any variable can be
retrieved, if you know its name. This provides an interesting backdoor for
developers (and ex-developers..)
Workaround:
You cannot avoid showing internal variables, but you can reduce the risk
from the database connection exposure. Rewrite the Net.Data application so
all remote database access goes through local programs rather than
directly from the script.
Vendor's Response:
The bug has been posted on the Net.Data IBM managed forum, And on another
user forum, which is monitored by IBM. No response was received.
ADDITIONAL INFORMATION
The information has been provided by <mailto:shalom@venera.com> Shalom
Carmel.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Next message: support@securiteam.com: "[EXPL] OpenBSD and NetBSD LKM That Hides Files by Patching getdirentries()"
- Previous message: support@securiteam.com: "[NEWS] DB2 on iSeries Stored Procedures Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
