BMC Remedy Action Request System 未明漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1192079 漏洞类型 设计错误
发布时间 2007-01-17 更新时间 2007-01-18
CVE编号 CVE-2007-0310 CNNVD-ID CNNVD-200701-281
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://cxsecurity.com/issue/WLB-2007010077
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200701-281
|漏洞详情
BMCRemedyActionRequestSystem5.01.02补丁1267会很据一个登录的用户名是否有效而生成不同的错误信息,这使得远程攻击者可以决定出有效的账户名。
|漏洞EXP
=======================================================
 Remedy Action Request System User Enumeration
=======================================================

Davide Del Vecchio Adv#11

Discovered in: 08/01/2007

Version affected: Remedy Action Request System 5.01.02 Patch 1267.
The same vulnerable code could be present in other versions.

Reference: http://www.alighieri.org/advisories/advisory-remedy50102.txt

Software description:

From BMC Software website:
 "Remedy Action Request System 5.01.02 provides a consolidated Service
 Process Management platform for automating and managing Service
 Management business processes."

The problem:

During user login phase, it is possible to enumerate existing users
 examining the error messages provided by the software.

Suppling a non-existing user the error message is:

ARERR [612] No such user is registered with this server
	user: test,  server: 10.10.10.11

Unable to successfully log in to any server.

Suppling an existing user the error message is:

ARERR [329] Invalid password for an existing user
	user: user,  server: 10.10.10.11

Unable to successfully log in to any server.

Solution:

Vendor has been contacted 3 times with no answer.

Credits:

Davide Del Vecchio would like to thank his family and all
 the people supporting him and his research.
 Support the rosewitch project.

Disclaimer:

The information within this paper may change without notice. Use of this
 information constitutes acceptance for use in an AS IS condition.
 There are NO warranties with regard to this information. In no event shall
 the author be liable for any damages whatsoever arising out of or in
 connection with the use or spread of this information. Any use of this
 information is at the user's own risk.
 ^^^^^^^^

Please send suggestions, updates, and comments to:
Davide Del Vecchio "Dante Alighieri" - dante at alighieri dot org
http://www.alighieri.org ~ http://legaest.blogspot.com
|参考资料

来源:BID
名称:22066
链接:http://www.securityfocus.com/bid/22066
来源:BUGTRAQ
名称:20070115RemedyActionRequestSystem5.01.02-UserEnumeration
链接:http://www.securityfocus.com/archive/1/archive/1/456949/100/0/threaded
来源:MISC
链接:http://www.alighieri.org/advisories/advisory-remedy50102.txt
来源:SECUNIA
名称:23775
链接:http://secunia.com/advisories/23775
来源:OSVDB
名称:31658
链接:http://osvdb.org/31658
来源:XF
名称:rars-login-information-disclosure(31527)
链接:http://xforce.iss.net/xforce/xfdb/31527
来源:BUGTRAQ
名称:20070116Re:RemedyActionRequestSystem5.01.02-UserEnumeration
链接:http://www.securityfocus.com/archive/1/archive/1/457078/100/0/threaded
来源:VUPEN
名称:ADV-2007-0204
链接:http://www.frsirt.com/english/advisories/2007/0204
来源:SECTRACK
名称:1017515
链接:http://securitytracker.com/id?1017515
来源:SREASON
名称:2162
链接:http://securityreason.com/securityalert/2162