---------------------------------------------------------------------- IRM Security Advisory No. 017 Multiple Vulnerabilities in Infovista Portal SE Vulnerability Type / Importance: Directory Traversal / High Information Leakage / Low Problem Discovered: January 20th 2006 Vendor Contacted: January 20th 2006 Advisory Published: February 22nd 2006 ---------------------------------------------------------------------- Abstract: VistaPortal enables secure, browser-based access to service-centric performance information. The easy implementation, display and design of Portal-based dashboards and reports give accurate visibility into the performance of the entire global IT infrastructure. VistaPortal allows users to simultaneously view Key Performance Indicators (KPIs), real-time performance notifications and strategic business information, from which users can drill down to related real-time and historical reports residing in VistaMart, the InfoVista Server and VistaTroubleshooter. VistaPortal delivers rich, interactive content within a standards-based, open architecture that allows seamless integration with existing applications and easy incorporation of information into other Web Portals. (http://www.infovista.com/products/product_list.asp#vistaportal) Description: PortalSE allows a remote attacker to read any file on the filesystem as it runs with root privileges by default. It is also susceptible to a directory revelation issue. Technical Details: During a recent research engagement IRM found multiple vulnerabilites in the Infovista PortalSE software. Using specially crafted URLs it is possible to read any file on the filesystem. This is due to the product running with super-user privileges so it is possible to gain the system's password hashes. Additionally, when selecting a non-existent server in the server field then the response reveals a full directory path, which can be useful to an attacker in fingerprinting the underlying operating system and directory structure: - An error occured while accessing the report '<nonexistentserver>_31457': No Such Report Generated For You [-] Hide details /opt/InfoVista/PortalSE/files/default/<nonexistentserver>/31457/report.h tml (No such file or directory) java.io.FileNotFoundException: /opt/InfoVista/PortalSE/files/default/<nonexistentserver>/31457/report.h tml (No such file or directory) Vendor & Patch Information: The vendor has released a hotfix for the directory traversal issue (IV00038969) which should be applied. The vendor does not deem the information leakage of the directory path an issue and has not released a hotfix for this. Tested Versions: PortalSE 2.0 Build 20087 on Solaris 8 Credits: Research & Advisory: P Robinson Disclaimer: All information in this advisory is provided on an 'as is' basis in the hope that it will be useful. Information Risk Management Plc is not responsible for any risks or occurrences caused by the application of this information.