[NT] Netegrity SiteMinder smpwservicescgi.exe Target Redirection

From: SecuriTeam (support_at_securiteam.com)
Date: 01/18/05

  • Next message: SecuriTeam: "[NT] NodeManager Professional Buffer Overflow (%DATA)" 
    To: list@securiteam.com
Date: 18 Jan 2005 12:29:27 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Netegrity SiteMinder smpwservicescgi.exe Target Redirection
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.netegrity.com/products/products_SM_overview.cfm> Netegrity
    SiteMinder enables "companies to administer and consistently enforce user
    access to Web applications and by providing single sign-on (SSO) services
    to users".

    Due to improper filtering of user provided data, a remote attacker can
    cause the Netegrity SiteMinder's smpwservicescgi.exe CGI to redirect a
    user to a third party site, which in turn can be used in phishing attacks.

    DETAILS

    Netegrity's SiteMinder has a CGI called smpservicecgi.exe, which is used
    to authenticate a user prior to allowing him to access a restricted web
    page. One of this CGI's parameters allow the redirection of the user to a
    web site once the authentication process has been successful. This
    parameter however, does not check to which web site the user is
    redirected. This allows an attacker to redirect the user to whatever site
    he desires, while the user thinks this is the natural course of the logon
    process.

    Exploit:
    The following URL will illustrate the attack, once the user has
    successfully/unsuccessfully logged on he will be redirected to the
    http://www.google.com web site:
    http://vulnerable/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=http%3a%2f%2fwww%2google%2eccom

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:maru@scip.ch> Marc Ruef.
    The original article can be found at:
    <http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022>
    http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] NodeManager Professional Buffer Overflow (%DATA)"

    Relevant Pages

    • [NT] WebArchiveX Unsafe Methods Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... String userAgent, ... scripting' entry, but unfortunately has not changed the version number. ...
      (Securiteam)
    • [NEWS] IBM Net.Data Macro Name Cross-Site Scripting Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The vulnerability is caused due to an input validation error in the db2www ... The vendor recommends that the "DTW_DEFAULT_ERROR_MESSAGE" feature (or ...
      (Securiteam)
    • [NEWS] TRUSTe.org Cross Site Scripting and Phishing Opportunities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... and guidance of many established companies and industry experts, TRUSTe ...
      (Securiteam)
    • [NT] FastStone 4in1 Browser Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... FastStone 4in1 Browser does not properly sanitize the directory reference ...
      (Securiteam)
    • Re: How to fight pedo French like Deckard in Thailand (Technical data)
      ... Despite their taste for spicy food, most of the Thai people that I know ... forward to say that the YouTube block was not unique - that strange ... Their web site was suddenly responding slowly and some users ... that the same HTTP 301 redirect was happening, ...
      (soc.culture.thai)
    Loading