Sourcefire 3D Sensor and DC, privilege escalation vulnerability

2009-07-02 / 2009-07-03
Risk: High
Local: No
Remote: Yes
CWE: CWE-264


CVSS Base Score: 9/10
Impact Subscore: 10/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Affected product ---------------- Sourcefire 3D Sensor and Defense Center 4.8.x Tested on 4.8.0.3 and 4.8.0.4, 3D Sensor 2500 & DC 1000 All 4.8.x releases, up to and including 4.8.1, confirmed vulnerable by sourcefire. Vulnerability details --------------------- A privilege escalation vulnerability found in the Sensor and the DC web based management interfaces allows any local account to take over the appliances administrator role. While the "user.cgi" PERL script correctly validates that incoming requests belong to an authenticated session, in such a case it also blindly grants read/write access to all accounts configuration with no regard for the role of the request's originator. Therefore a user with even the lowest level of access (ie. without any role configured) is able to promote himself as administrator and/or change others roles and account parameters at will. Depending of the role or roles initially configured for this user, access to the user management page may not be visible into the interface's layout however the underlying script itself is still reachable and can be invoked "by hand". Let's now consider a malicious operator named 'foobar' whose role has been restricted to "Event analyst (read only)". He would first log in to the appliance using his own credentials in order to get an authenticated session cookie (CGISESSID=xxxxxxxxxxxxxxxxxx) then he could send a forged POST request similar to the one below: POST https://x.x.x.x/admin/user/user.cgi HTTP/1.1 User-Agent: xxxxxx Keep-Alive: 300 Connection: Keep-alive Cookie: CGISESSID=xxxxxxxxxxxxxxxxxx Content-Type: application/x-www-form-urlencoded Content-length: 56 mode=edit&username=foobar&admin=%24admin&action_add=Save He would thereafter be promoted to administrator by the appliance with full access into the management interface. As a final note, several other scripts were reported being affected by the same vulnerability after investigation from the vendor. Resolution ---------- Upgrade your appliance's software to 4.8.2 available from the Sourcefire's support website located at https://support.sourcefire.com/ Disclosure timeline ------------------- 2009-05-05: Vulnerability discovered and reported to Sourcefire. 2009-06-30: 4.8.2 released by Sourcefire. 2009-07-01: Public disclosure. Gregory Duchemin


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top