NetSupport Manager Authentication Bypass

2007.09.25
Risk: High
Local: No
Remote: Yes
CWE: CWE-287


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Title ----- NetSupport Manager Authentication Bypass Severity -------- High Date Discovered --------------- 9/4/2007 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Additional Discovered By (Digital Defense, Inc. Credit: sxkeebler and r@b13s Vulnerability Description ------------------------- The NetSupport Manager client that listens on TCP port 5405 does not properly handle authentication sessions. It is possible to pose as the NetSupport Manager, associate to a client, and then issue commands without performing the authentication sequence. Both the basic and advanced authentication schemes can be bypassed in the same manner. When properly exploited, this flaw will results in a complete compromise of the target system. Solution Description -------------------- Digital Defense, Inc. notified NetSupport on September 9, 2007 of this flaw but did not receive any response or acknowledgement from the vendor. However, NetSupport has released a patch for this flaw as described by NetSupport Technical Document ID TD543. Tested Systems / Software (with versions) ----------------------------------------- NetSupport Manager 10.20 running on Windows XP SP2 and Windows 2K3 SP2. NetSupport acknowledges in Technical Document ID TD543 that the following versions of the NetSupport Manager are vulnerable to this flaw: NSM 5.00, NSM 5.01, NSM 5.02, NSM 5.02f1, NSM 5.03, NSM 5.05, NSM 5.30, NSM 5.31, NSM 6.00, NSM 6.10, NSM 6.11, NSM 7.01, NSM 7.10, NSM 8.00, NSM 8.10, NSM 9.00, NSM 8.50, NSM 8.60, NSM 9.10, NSM 9.50, NSM 9.60, NSM 10.00, NSM 10.20 Vendor Contact -------------- NetSupport http://www.netsupportmanager.com/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top