Bug: Remedy Action Request System 5.01.02 - User Enumeration ( Ascii Version )

Search:
WLB2

Remedy Action Request System 5.01.02 - User Enumeration

Published
Credit
Risk
2007.01.22
Davide Del Vecchio
Low
CWE
CVE
Local
Remote
N/A
CVE-2007-0310
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

=======================================================
Remedy Action Request System User Enumeration
=======================================================

Davide Del Vecchio Adv#11

Discovered in: 08/01/2007

Version affected: Remedy Action Request System 5.01.02 Patch 1267.
The same vulnerable code could be present in other versions.

Reference: http://www.alighieri.org/advisories/advisory-remedy50102.txt

Software description:

From BMC Software website:
"Remedy Action Request System 5.01.02 provides a consolidated Service
Process Management platform for automating and managing Service
Management business processes."

The problem:

During user login phase, it is possible to enumerate existing users
examining the error messages provided by the software.

Suppling a non-existing user the error message is:

ARERR [612] No such user is registered with this server
user: test, server: 10.10.10.11

Unable to successfully log in to any server.

Suppling an existing user the error message is:

ARERR [329] Invalid password for an existing user
user: user, server: 10.10.10.11

Unable to successfully log in to any server.

Solution:

Vendor has been contacted 3 times with no answer.

Credits:

Davide Del Vecchio would like to thank his family and all
the people supporting him and his research.
Support the rosewitch project.

Disclaimer:

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
^^^^^^^^

Please send suggestions, updates, and comments to:
Davide Del Vecchio "Dante Alighieri" - dante at alighieri dot org
http://www.alighieri.org ~ http://legaest.blogspot.com

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version