ID

VAR-200711-0143

CVE

CVE-2007-6096

TITLE

Ingate Firewall and SIParator Vulnerable to reading plaintext passwords

DESCRIPTION

Ingate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of "administrators with less privileges," which might allow attackers to read these passwords via unknown vectors. Ingate Firewall and SIParator products are prone to multiple vulnerabilities that include buffer-overflow, information-disclosure, and denial-of-service issues. An attacker may access sensitive information, cause denial-of-service conditions, or potentially execute arbitrary code. Versions prior to Ingate Firewall 4.6.0 and Ingate SIParator 4.6.0 are vulnerable. Both Ingate Firewall and SIParator are enterprise-level hardware firewall devices. Sensitive information disclosure vulnerabilities exist in Ingate Firewall and SIParator. The password of the administrator \"administration\" account is stored in plain text, which may cause malicious attackers to obtain the password information of the management account through unknown means. ---------------------------------------------------------------------- 2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published How do you know which Secunia advisories are important to you? The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively. Get a free trial of the Secunia Vulnerability Intelligence Solutions: http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv ---------------------------------------------------------------------- TITLE: Ingate Firewall and SIParator Multiple Vulnerabilities SECUNIA ADVISORY ID: SA27688 VERIFY ADVISORY: http://secunia.com/advisories/27688/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information, DoS, System access WHERE: >From remote OPERATING SYSTEM: Ingate Firewall 4.x http://secunia.com/product/4050/ Ingate SIParator 4.x http://secunia.com/product/5687/ DESCRIPTION: Some vulnerabilities and security issues have been reported in Ingate Firewall and SIParator, which potentially can be exploited by malicious people or users to cause a DoS (Denial of Service) or gain knowledge of sensitive information, or by malicious people to compromise a vulnerable system. 1) A boundary error in libsrtp can be exploited to cause a buffer overflow. 2) An error in the SRTP component when processing an overly large RTCP index could cause a kernel crash. 3) An error when processing IPsec phase two proposals without PFS could cause the IPSec module to crash. 4) An error in the SIP component when using Remote NAT Traversal could allow user's registrations to conflict and messages to be sent to the wrong user. Other issues have also been reported, which may have security impacts. SOLUTION: Update to version 4.6.0. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.ingate.com/relnote-460.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

trust management

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Ingate Systems

SOURCES

LAST UPDATE DATE

2024-11-23T22:03:48.180000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE