|
IP3 Networks NA75 SQL Injection Vulnerability and Weaknesses
|
|
Secunia Advisory:
|
SA19818
|
|
|
Release Date:
|
2006-04-26
|
|
Last Update:
|
2006-04-28
|
|
Popularity:
|
5,529 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
Manipulation of data
Exposure of sensitive information
Privilege escalation
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | IP3 Networks NA75
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-2043
CVE-2006-2044
CVE-2006-2045
|
|
Description:
Ralph Moonen has reported a vulnerability and some weaknesses in IP3 Networks NA75, which can be exploited by malicious, local users to potentially gain escalated privileges and disclose or manipulate sensitive information, or by malicious people to conduct SQL injection attacks.
1) Some input passed in the web interface is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Example:
* The password field during login.
2) Some input validation errors in the command line interface can be exploited to inject arbitrary shell commands via the "`" backtick character.
3) The shadow password file has world-readable permissions, which can be exploited to disclose other users' encrypted passwords.
4) The database file is stored with world-readable and world-writable permissions.
The vulnerability and weaknesses have been reported in firmware version 4.0.34. Other versions may also be affected.
Solution:
Apply patch available from the vendor.
http://www.ip3.com/supportoverview.htm
Provided and/or discovered by:
Ralph Moonen
Changelog:
2006-04-28: Added CVE references.
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
