ID
VAR-200605-0057
CVE
CVE-2006-2355
TITLE
Ipswitch WhatsUp Professional 404 Error message Information disclosure vulnerability
Trust: 0.6
DESCRIPTION
Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. 1) Input passed to NmConsole/Navigation.asp and to the "sHostname" parameter in NmConsole/ToolResults.asp is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of a vulnerable site. Example: http://[host]:8022/NmConsole/Navigation.asp?">[code] 2) Input passed to NmConsole/Tools.asp and NmConsole/DeviceSelection.asp is also not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of a vulnerable site. 3) It's possible to disclose monitored devices without being logged in by passing arbitrary values to the "nDeviceGroupID" parameter in "NmConsole/utility/RenderMap.asp". Example: http://[host]:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=2 4) Input passed to the "sRedirectUrl" and "sCancelURL" in NmConsole/DeviceSelection.asp is not properly verified, which makes it possible to redirect a user to an arbitrary web site. It is also possible to disclose the source code of the ASP pages by appending a period to the end of the file extension. 5) Different error messages are returned during login to "NmConsole/Login.asp" depending on whether the supplied username or password is incorrect. SOLUTION: Restrict access to port 8022/tcp and don't visit other web sites while logged in. PROVIDED AND/OR DISCOVERED BY: 1, 3, 4) David Maciejak 2, 5, 6) Reported by an anonymous person. ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
Trust: 1.35
AFFECTED PRODUCTS
| vendor: | ipswitch | model: | whatsup professional | scope: | eq | version: | 2006 | Trust: 1.6 |
| vendor: | ipswitch | model: | whatsup professional | scope: | eq | version: | 2006_premium | Trust: 1.6 |
| vendor: | ipswitch | model: | whatsup professional | scope: | eq | version: | 20060 | Trust: 0.3 |
| vendor: | ipswitch | model: | whatsup professional premium | scope: | eq | version: | 20052006 | Trust: 0.3 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-Other | Trust: 1.0 |
THREAT TYPE
remote
Trust: 0.6
TYPE
unknown
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2006-2355 | Trust: 2.0 |
| db: | SECUNIA | id: | 20075 | Trust: 1.8 |
| db: | OSVDB | id: | 25477 | Trust: 1.7 |
| db: | XF | id: | 26504 | Trust: 0.9 |
| db: | CNNVD | id: | CNNVD-200605-281 | Trust: 0.7 |
| db: | XF | id: | 404 | Trust: 0.6 |
| db: | BID | id: | 87645 | Trust: 0.4 |
| db: | VULHUB | id: | VHN-18463 | Trust: 0.1 |
| db: | PACKETSTORM | id: | 46269 | Trust: 0.1 |
REFERENCES
| url: | http://www.osvdb.org/25477 | Trust: 1.7 |
| url: | http://secunia.com/advisories/20075 | Trust: 1.7 |
| url: | https://exchange.xforce.ibmcloud.com/vulnerabilities/26504 | Trust: 1.1 |
| url: | http://xforce.iss.net/xforce/xfdb/26504 | Trust: 0.9 |
| url: | http://secunia.com/product/9917/ | Trust: 0.1 |
| url: | http://secunia.com/secunia_security_advisories/ | Trust: 0.1 |
| url: | http://[host]:8022/nmconsole/utility/rendermap.asp?ndevicegroupid=2 | Trust: 0.1 |
| url: | http://secunia.com/advisories/20075/ | Trust: 0.1 |
| url: | http://secunia.com/product/9918/ | Trust: 0.1 |
| url: | http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org | Trust: 0.1 |
| url: | http://[host]:8022/nmconsole/navigation.asp?">[code] | Trust: 0.1 |
| url: | http://[host]:8022/nmconsole | Trust: 0.1 |
| url: | http://secunia.com/about_secunia_advisories/ | Trust: 0.1 |
CREDITS
Unknown
Trust: 0.3
SOURCES
| db: | VULHUB | id: | VHN-18463 |
| db: | BID | id: | 87645 |
| db: | PACKETSTORM | id: | 46269 |
| db: | CNNVD | id: | CNNVD-200605-281 |
| db: | NVD | id: | CVE-2006-2355 |
LAST UPDATE DATE
2024-08-14T13:49:41.453000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-18463 | date: | 2017-07-20T00:00:00 |
| db: | BID | id: | 87645 | date: | 2006-05-15T00:00:00 |
| db: | CNNVD | id: | CNNVD-200605-281 | date: | 2006-05-15T00:00:00 |
| db: | NVD | id: | CVE-2006-2355 | date: | 2017-07-20T01:31:24.193 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-18463 | date: | 2006-05-15T00:00:00 |
| db: | BID | id: | 87645 | date: | 2006-05-15T00:00:00 |
| db: | PACKETSTORM | id: | 46269 | date: | 2006-05-17T05:39:52 |
| db: | CNNVD | id: | CNNVD-200605-281 | date: | 2006-05-15T00:00:00 |
| db: | NVD | id: | CVE-2006-2355 | date: | 2006-05-15T10:02:00 |