Re: NetObserve Security Bypass Vulnerability

"Peter Winter-Smith" <[email protected]>
Newsgroups gmane.comp.security.vulnerabilities.watch.announce,gmane.comp.security.bugtraq
Message-ID <[email protected]>
Re: NetObserve Security Bypass Vulnerability

############################################

Credit:
Author     : Peter Winter-Smith

Software:
Packages   : NetObserve
Version    : 2.0 and prior
Vendor     : ExploreAnywhere Software
Vendor Url : http://www.exploreanywhere.com/no-intro.php

Vulnerability:
Bug Type   : Security Bypass
Severity   : Highly Critical
              + Remote System Command Via NetObserve

UPDATE:

I may have been a little unclear in my description of the
exploitability of this flaw. It seems that I interchanged the words
'administrator' and 'remote user' giving the impression that only a
current'user' of the administration panel can compromise the system
through these flaws. In actual fact it is possible to compromise a system
running NetObserve without being any kind of authenticated user or
administrator!

I thought I should mention this because it has been labelled as only
exploitable by current users of the NetObserve system, which is
technically incorrect - anyone can exploit it  :-)

The complete document on this flaw can be found at:
http://www.elitehaven.net/netobserve.txt

Thanks to you all for the tireless effort and research work which you
put into the security community!

-Peter Winter-Smith

_________________________________________________________________
Tired of 56k? Get a FREE BT Broadband connection 
http://www.msn.co.uk/specials/btbroadband
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.