[NEWS] Neoteris IVE changepassword.cgi Authentication Bypass

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Neoteris IVE changepassword.cgi Authentication Bypass
------------------------------------------------------------------------


SUMMARY

 <www.juniper.net> Neoteris Instant Virtual Extranet (IVE) is "a well 
known 'clientless' SSL VPN solution for internal network remote access via 
a standard web browser. It is widely used as an extranet portal for 
corporate networks".

An attacker can exploit an authentication weakness in Neoteris IVE's 
changepassword.cgi to brute force password of LDAP users configured on the 
system.

DETAILS

Vulnerable Systems:
 * Neoteris Instant Virtual Extranet (IVE) OS, Version 3.x Netories 
Instant Virtual Extranet (IVE) OS, Version 4.x

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0939> 
CAN-2004-0939

When a valid user tries to authenticate via the IVE and the password is 
expired, the user will be asked to change their password and be directly 
forwarded to the "changepassword.cgi" without asking for any form of 
authentication. The username, authentication server and type will be 
appended to the changepassword.cgi URL.

Since the changepassword.cgi allows the user to try the old password as 
many times as they want, the unit effectively allows a brute force 
password attack.
If an attacker were to obtain a username through various public 
information gathering techniques, they could attempt to find an account 
with a password that has expired and brute force that account to 
eventually gain unauthorized access.

This vulnerability only affects IVE products that are configured with LDAP 
or an NT domain authentication server. Other type of authentication 
servers are  not  affected.

Vendor Status:
The vendor has released a patch and an advisory to address this issue. The 
advisory is available the following location:  
<http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach&txtAlertNumber=PSN-2004-08-25&viewMode=view> http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach &txtAlertNumber=PSN-2004-08-25&viewMode=view


ADDITIONAL INFORMATION

The original article can be found at:  
<http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt> 
http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.