[NT] Nortel SSL VPN Cross Site Scripting and Command Execution

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Nortel SSL VPN Cross Site Scripting and Command Execution
------------------------------------------------------------------------


SUMMARY

The
<http://products.nortel.com/go/product_content.jsp?segId=0&parId=0&prod_id=38760&locale=en-US> Nortel SSL VPN is a remote access security solution. By using secure sockets layer (SSL) as the underlying security protocol, Nortel SSL VPN allows for using the Internet for remote connectivity and the ubiquitous Web browser as the primary client interface.

Due to insufficient input validation within the appliance's web interface,
it is possible for an attacker to supply his victim with a malicious link
that results in code execution on the victim's client.

DETAILS

Vulnerable Systems:
* Nortel SSL VPN version 4.2.1.6

Due to insufficient input validation within the web interface of Nortel's
SSL VPN appliance, it is possible to hide commands in links to certain
pages of the web interface. As the Java Applet which is called from those
web pages is cryptographically signed, it may execute operating system
commands with the privileges of the user sitting in front of the browser.

An attacker can thus supply a victim with malicious link where remote
commands are hidden. If the victim clicks on the link and logs onto the
SSL VPN web interface (where it is automatically taken), arbitrary
commands are executed locally on the client of the victim.

Example:
Here is an example for a crafted link that executes the command "cmd.exe
/c echo test > c:\\test"
https://SSL_VPN_SERVER/tunnelform.yaws?a=+cmd.exe+/c+echo+test+%3E+c:\\test.txt+&type=Custom&sp=443&n=1&ph=&pp=&0tm=tcp&0lh=127.0.0.1&0lp=8080&0hm=&0rh=10.10.10.10&0rp=80&sslEnabled=on&start=Start...

Vendor Status:
Vendor notified: 2005-05-30
Vendor response: 2005-06-21
Patch available: 2005-11-15
Public disclosure.: 2006-12-12

* According to vendor, a patch for this vulnerability has been
incorporated into maintenance release v5.1.5 of its VPN Gateway.


ADDITIONAL INFORMATION

The information has been provided by <mailto:research@xxxxxxxxxxxxxxx>
SEC Consult Research.
The original article can be found at:
<http://www.sec-consult.com/236.html> http://www.sec-consult.com/236.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages