ID

VAR-200604-0489

CVE

CVE-2006-2045

TITLE

IP3 Networks NetAccess NA75 Information disclosure vulnerability

DESCRIPTION

The (1) shadow password file in na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has world readable permissions, which allows local users to view encrypted passwords; and the (2) NetAccess database file has world readable and writable permissions, which allows local users to view sensitive information and modify data. IP3 Networks NetAccess NA75 devices are susceptible to multiple local vulnerabilities: - A command-injection vulnerability due to insufficient input-sanitization of user-supplied commands. This issue allows attackers to execute arbitrary shell commands in the underlying UNIX-based operating system. - An encrypted-password information-disclosure vulnerability. This issue may aid attackers in brute-force password-guessing attacks. - An insecure default-permissions vulnerability. This issue allows attackers to access or corrupt potentially sensitive information. These issues are present in version 4.0.34 of the device's firmware; other versions may also be affected. TITLE: IP3 Networks NA75 SQL Injection Vulnerability and Weaknesses SECUNIA ADVISORY ID: SA19818 VERIFY ADVISORY: http://secunia.com/advisories/19818/ CRITICAL: Less critical IMPACT: Security Bypass, Manipulation of data, Exposure of sensitive information, Privilege escalation WHERE: >From local network OPERATING SYSTEM: IP3 Networks NA75 http://secunia.com/product/9602/ DESCRIPTION: Ralph Moonen has reported a vulnerability and some weaknesses in IP3 Networks NA75, which can be exploited by malicious, local users to potentially gain escalated privileges and disclose or manipulate sensitive information, or by malicious people to conduct SQL injection attacks. 1) Some input passed in the web interface is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Example: * The password field during login. 2) Some input validation errors in the command line interface can be exploited to inject arbitrary shell commands via the "`" backtick character. 4) The database file is stored with world-readable and world-writable permissions. SOLUTION: Apply patch available from the vendor. http://www.ip3.com/supportoverview.htm PROVIDED AND/OR DISCOVERED BY: Ralph Moonen ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

lack of information

EXTERNAL IDS

REFERENCES

CREDITS

Ralph Moonen reported these vulnerabilities.

SOURCES

LAST UPDATE DATE

2024-08-14T13:08:19.674000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE