[NEWS] Neoteris IVE changepassword.cgi Authentication Bypass

From: SecuriTeam (support_at_securiteam.com)
Date: 05/26/05

  • Next message: SecuriTeam: "[NT] Halo: Combat Evolved DoS" 
    To: list@securiteam.com
Date: 26 May 2005 17:58:48 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Neoteris IVE changepassword.cgi Authentication Bypass
    ------------------------------------------------------------------------

    SUMMARY

     <www.juniper.net> Neoteris Instant Virtual Extranet (IVE) is "a well
    known 'clientless' SSL VPN solution for internal network remote access via
    a standard web browser. It is widely used as an extranet portal for
    corporate networks".

    An attacker can exploit an authentication weakness in Neoteris IVE's
    changepassword.cgi to brute force password of LDAP users configured on the
    system.

    DETAILS

    Vulnerable Systems:
     * Neoteris Instant Virtual Extranet (IVE) OS, Version 3.x Netories
    Instant Virtual Extranet (IVE) OS, Version 4.x

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0939>
    CAN-2004-0939

    When a valid user tries to authenticate via the IVE and the password is
    expired, the user will be asked to change their password and be directly
    forwarded to the "changepassword.cgi" without asking for any form of
    authentication. The username, authentication server and type will be
    appended to the changepassword.cgi URL.

    Since the changepassword.cgi allows the user to try the old password as
    many times as they want, the unit effectively allows a brute force
    password attack.
    If an attacker were to obtain a username through various public
    information gathering techniques, they could attempt to find an account
    with a password that has expired and brute force that account to
    eventually gain unauthorized access.

    This vulnerability only affects IVE products that are configured with LDAP
    or an NT domain authentication server. Other type of authentication
    servers are not affected.

    Vendor Status:
    The vendor has released a patch and an advisory to address this issue. The
    advisory is available the following location:
    <http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach&txtAlertNumber=PSN-2004-08-25&viewMode=view> http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach &txtAlertNumber=PSN-2004-08-25&viewMode=view

    ADDITIONAL INFORMATION

    The original article can be found at:
    <http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt>
    http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Halo: Combat Evolved DoS"

    Relevant Pages

    • [UNIX] Apache mod_auth_pgsql Format String Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache mod_auth_pgsql Format String Vulnerability ... mod_auth_pgsql "allows user authentication (and can log authentication ... The mod_auth_pgsql module for the Apache httpd is a third party ...
      (Securiteam)
    • [NT] PGP Authentication and User Managment Bypass
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PGP Authentication and User Managment Bypass ... A design flaw allows attackers to bypass authentication with PGP SDA. ...
      (Securiteam)
    • [NEWS] Novell ZENWorks Multiple Remote Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This authentication protocol contains several stack and heap ... overflows that can be triggered by an unauthenticated remote attacker to ... Exploiting those vulnerabilities may lead to executing ...
      (Securiteam)
    • [UNIX] MySQL Authentication Scheme Bypass
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... By submitting a carefully crafted authentication packet, ... the user has specified a 'scrambled' string that is as long ... stack-based buffer 'buff' can be overflowed by a long 'scramble' string. ...
      (Securiteam)
    • [NT] MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface ... *not* require authentication. ...
      (Securiteam)