Sign-up

ID

VAR-200604-0487


CVE

CVE-2006-2043


TITLE

IP3 Networks NetAccess NA75 Multiple Local Vulnerabilities

Trust: 0.9

sources: BID: 17698 // CNNVD: CNNVD-200604-519

DESCRIPTION

na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "`" (backtick) characters in the appliance's command line interface (CLI). IP3 Networks NetAccess NA75 devices are susceptible to multiple local vulnerabilities: - A command-injection vulnerability due to insufficient input-sanitization of user-supplied commands. This issue allows attackers to execute arbitrary shell commands in the underlying UNIX-based operating system. - An encrypted-password information-disclosure vulnerability. This issue may aid attackers in brute-force password-guessing attacks. - An insecure default-permissions vulnerability. This issue allows attackers to access or corrupt potentially sensitive information. These issues are present in version 4.0.34 of the device's firmware; other versions may also be affected. TITLE: IP3 Networks NA75 SQL Injection Vulnerability and Weaknesses SECUNIA ADVISORY ID: SA19818 VERIFY ADVISORY: http://secunia.com/advisories/19818/ CRITICAL: Less critical IMPACT: Security Bypass, Manipulation of data, Exposure of sensitive information, Privilege escalation WHERE: >From local network OPERATING SYSTEM: IP3 Networks NA75 http://secunia.com/product/9602/ DESCRIPTION: Ralph Moonen has reported a vulnerability and some weaknesses in IP3 Networks NA75, which can be exploited by malicious, local users to potentially gain escalated privileges and disclose or manipulate sensitive information, or by malicious people to conduct SQL injection attacks. 1) Some input passed in the web interface is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Example: * The password field during login. 3) The shadow password file has world-readable permissions, which can be exploited to disclose other users' encrypted passwords. 4) The database file is stored with world-readable and world-writable permissions. SOLUTION: Apply patch available from the vendor. http://www.ip3.com/supportoverview.htm PROVIDED AND/OR DISCOVERED BY: Ralph Moonen ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.35

sources: NVD: CVE-2006-2043 // BID: 17698 // VULHUB: VHN-18151 // PACKETSTORM: 45748

AFFECTED PRODUCTS

vendor:ip3model:netaccess 75scope:eqversion:4.0.34

Trust: 1.6

vendor:ip3model:networks na75scope:eqversion:4.0.34

Trust: 0.3

sources: BID: 17698 // CNNVD: CNNVD-200604-519 // NVD: CVE-2006-2043

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-2043
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200604-519
value: MEDIUM

Trust: 0.6

VULHUB: VHN-18151
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2006-2043
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-18151
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-18151 // CNNVD: CNNVD-200604-519 // NVD: CVE-2006-2043

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-2043

THREAT TYPE

local

Trust: 1.0

sources: BID: 17698 // PACKETSTORM: 45748 // CNNVD: CNNVD-200604-519

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200604-519

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-18151

EXTERNAL IDS
db:BIDid:17698
Trust: 2.0
db:SECUNIAid:19818
Trust: 1.8
db:SREASONid:793
Trust: 1.7
db:VUPENid:ADV-2006-1540
Trust: 1.7
db:NVDid:CVE-2006-2043
Trust: 1.7
db:CNNVDid:CNNVD-200604-519
Trust: 0.7
db:BUGTRAQid:20060424 MULTIPLE VULNERABILITIES IN IP3 NETWORKS 'NETACCESS' NA75 APPLIANCE
Trust: 0.6
db:XFid:26108
Trust: 0.6
db:XFid:3
Trust: 0.6
db:EXPLOIT-DBid:9688
Trust: 0.1
db:VULHUBid:VHN-18151
Trust: 0.1
db:PACKETSTORMid:45748
Trust: 0.1
sources:
            
            
            VULHUB: VHN-18151 // 
            
            
            
            BID: 17698 // 
            
            
            
            PACKETSTORM: 45748 // 
            
            
            
            CNNVD: CNNVD-200604-519 // 
            
            
            
            NVD: CVE-2006-2043

REFERENCES
url:http://www.securityfocus.com/bid/17698
Trust: 1.7
url:http://secunia.com/advisories/19818
Trust: 1.7
url:http://securityreason.com/securityalert/793
Trust: 1.7
url:http://www.securityfocus.com/archive/1/432007/100/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2006/1540
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/26108
Trust: 1.1
url:http://www.securityfocus.com/archive/1/archive/1/432007/100/0/threaded
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/26108
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2006/1540
Trust: 0.6
url:http://ip3networks.com/na75.htm
Trust: 0.3
url:http://www.ip3.com/
Trust: 0.3
url:/archive/1/432007
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://www.ip3.com/supportoverview.htm
Trust: 0.1
url:http://secunia.com/product/9602/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/19818/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-18151 // 
            
            
            
            BID: 17698 // 
            
            
            
            PACKETSTORM: 45748 // 
            
            
            
            CNNVD: CNNVD-200604-519 // 
            
            
            
            NVD: CVE-2006-2043

CREDITS
Ralph Moonen reported these vulnerabilities.
Trust: 0.9
sources:
            
            
            BID: 17698 // 
            
            
            
            CNNVD: CNNVD-200604-519

SOURCES
db:VULHUBid:VHN-18151
db:BIDid:17698
db:PACKETSTORMid:45748
db:CNNVDid:CNNVD-200604-519
db:NVDid:CVE-2006-2043

LAST UPDATE DATE
2024-08-14T12:32:17.025000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-18151date:2018-10-18T00:00:00
db:BIDid:17698date:2006-04-26T20:56:00
db:CNNVDid:CNNVD-200604-519date:2006-04-27T00:00:00
db:NVDid:CVE-2006-2043date:2018-10-18T16:37:48.847

SOURCES RELEASE DATE
db:VULHUBid:VHN-18151date:2006-04-26T00:00:00
db:BIDid:17698date:2006-04-25T00:00:00
db:PACKETSTORMid:45748date:2006-04-27T21:57:26
db:CNNVDid:CNNVD-200604-519date:2006-04-26T00:00:00
db:NVDid:CVE-2006-2043date:2006-04-26T20:06:00