[NEWS] Enterasys Networks Multiple NetSight Products Multiple Vulnerabilities
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 8 Apr 2007 13:43:56 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Enterasys Networks Multiple NetSight Products Multiple Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://www.enterasys.com/products/management/> NetSight is "a graphical
network management platform combining multiple products into one console".
Multiple vulnerabilities exists within the TFTPD and BOOTPD server
components of various Enterasys Networks NetSight products.
DETAILS
Vulnerable Systems:
* TFTPD and BOOTPD component of the NetSight packages on the Windows XP
and Windows 2000 platform are vulnerable.
* NetSight Console 2.1
* NetSight Inventory Manager 2.1
* Previous versions of the products, and versions for other platforms,
may also contain vulnerable code, however this has not been confirmed.
Immune Systems:
* iDefense has confirmed that the following releases of Enterasys'
NetSight products are no longer vulnerable.
* NetSight Console 2.3.1 build 6
* NetSight Inventory Manager 2.2.2 build 4
The TFTPD server component of various Enterasys Networks NetSight products
contains a buffer overflow in the file name portion of a request packet.
By sending a request packet with a long file name, it is possible to cause
an exploitable stack based buffer overflow.
The BOOTPD server component of various Enterasys Networks NetSight
products fails to validate the "packet type" field of packets it receives.
By sending a UDP packet with a an invalid "packet type" it is possible to
cause an the server to exit.
These services typically run as an administrative user. As the services
use the UDP protocol, the source address of packets could be spoofed. This
may allow bypassing of some host based firewall rules designed to limit
connections to trusted clients.
Workaround:
These services can be stopped and started from an icon in the system tray.
It is recommended that they not be activated unless required. Restricting
access to the services to trusted clients may not be a viable option, as
the services use the UDP protocol, which an attacker can easily spoof.
Disclosure Timeline:
* 08/16/2006 - Initial vendor notification
* 08/16/2006 - Initial vendor response
* 04/04/2007 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NT] AOL Nullsoft Winamp IT Module Heap Memory Corruption (IN_MOD.DLL)
- Next by Date: [EXPL] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
- Previous by thread: [NT] AOL Nullsoft Winamp IT Module Heap Memory Corruption (IN_MOD.DLL)
- Next by thread: [EXPL] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
- Index(es):
Relevant Pages
- [NT] Timbuktu Pro Path Traversal and Log Injection
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Several fields of the packet
... The other bug is a logging file content manipulation vulnerability ... chunk
should be set ... (Securiteam) - [UNIX] PPPd DoS
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Point-to-Point Protocol
for Unix systems". ... It reads in the packet at line 932, ... The loop continues
processing the packet as long as len is!= 0. ... (Securiteam) - [NT] Technical Description of the SSL PCT Vulnerability
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... thorough and detailed analysis
of the vulnerability in MS's SSL library is ... the variable N is taken from the packet
itself. ... In this context a "valid field value" is one that allows the execution ...
(Securiteam) - [EXPL] autoRST - Automated TCP RST Exploit
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... sniff for TCP packets on
a network and then sends out a forged RST packet ... * winpcap header files downloaded
and paths setup. ... typedef struct mac_address { ... (Securiteam) - [EXPL] Counter Strike 2D DoS (Exploit)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Dim ConnectionPacket As String
' Declare our Connection String ... Dim DoSPacket As String ' Declare our DoS Packet ...
Private Sub cmdAttack_Click ... (Securiteam)
