SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Device (Intrusion Detection)  >   Sourcefire Intrusion Sensors Vendors:   Sourcefire
Sourcefire 3D Sensor and Defense Center Lets Remote Authenticated Users Gain Elevated Privileges
SecurityTracker Alert ID:  1022500
SecurityTracker URL:  http://securitytracker.com/id/1022500
CVE Reference:   CVE-2009-2344   (Links to External Site)
Updated:  Jul 27 2009
Original Entry Date:  Jul 2 2009
Impact:   User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 4.8 - 4.8.1
Description:   A vulnerability was reported in Sourcefire 3D Sensor and Defense Center. A remote authenticated user can obtain elevated privileges on the target system.

A remote authenticated user can submit a specially crafted request to the 'user.cgi' script to gain read and write access with administrator privileges.

Other scripts on the device may also be affected.

The vendor was notified on May 5, 2009.

Gregory Duchemin reported this vulnerability.

Impact:   A remote authenticated user can obtain elevated privileges on the target system.
Solution:   The vendor has issued a fix (4.8.2).
Vendor URL:  www.sourcefire.com/ (Links to External Site)
Cause:   Access control error
Underlying OS:  

Message History:   None.


 Source Message Contents

Date:  Wed, 1 Jul 2009 14:44:41 -0600
Subject:  Sourcefire 3D Sensor and DC, privilege escalation vulnerability

Affected product
----------------

Sourcefire 3D Sensor and Defense Center 4.8.x
 
Tested on 4.8.0.3 and 4.8.0.4, 3D Sensor 2500 & DC 1000
All 4.8.x releases, up to and including 4.8.1, confirmed vulnerable by sourcefire.


Vulnerability details
---------------------

A privilege escalation vulnerability found in the Sensor and the DC web based management interfaces allows any local account
to take over the appliances administrator role.
While the "user.cgi" PERL script correctly validates that incoming requests belong to an authenticated session, in such a case 
it also blindly grants read/write access to all accounts configuration with no regard for the role of the request's originator. 
Therefore a user with even the lowest level of access (ie. without any role configured) is able to promote himself as administrator
 
and/or change others roles and account parameters at will. 
Depending of the role or roles initially configured for this user, access to the user management page may not be visible
into the interface's layout however the underlying script itself is still reachable and can be invoked "by hand".

Let's now consider a malicious operator named 'foobar' whose role has been restricted to "Event analyst (read only)".
He would first log in to the appliance using his own credentials in order to get an authenticated session cookie (CGISESSID=xxxxxxxxxxxxxxxxxx)
then he could send a forged POST request similar to the one below:
 
POST https://x.x.x.x/admin/user/user.cgi HTTP/1.1
User-Agent: xxxxxx
Keep-Alive: 300
Connection: Keep-alive
Cookie: CGISESSID=xxxxxxxxxxxxxxxxxx
Content-Type: application/x-www-form-urlencoded
Content-length: 56

mode=edit&username=foobar&admin=%24admin&action_add=Save

He would thereafter be promoted to administrator by the appliance with full access into the management interface.
 
As a final note, several other scripts were reported being affected by the same vulnerability after investigation from the vendor.


Resolution
----------

Upgrade your appliance's software to 4.8.2 available from the Sourcefire's support website located at https://support.sourcefire.com/


Disclosure timeline
-------------------

2009-05-05: Vulnerability discovered and reported to Sourcefire.
2009-06-30: 4.8.2 released by Sourcefire.
2009-07-01: Public disclosure.



Gregory Duchemin



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC