BugTraq
SEC Consult SA-20141219-0 :: XSS & Memory Disclosure vulnerabilities in NetIQ eDirectory NDS iMonitor Dec 19 2014 10:09AM
SEC Consult Vulnerability Lab (research sec-consult com)
SEC Consult Vulnerability Lab Security Advisory < 20141219-0 >
=======================================================================
title: XSS & Memory Disclosure
product: NetIQ eDirectory NDS iMonitor
vulnerable version: 8.8 SP8, 8.8 SP7
fixed version: 8.8 SP8 HF 4,
fix available for versions 8.8 SP7 (8.8.7.4 HF 4,
8.8.7.6 HF 3)
CVE number: CVE-2014-5212, CVE-2014-5213
impact: High
homepage: https://www.netiq.com/
found: 2014-10-29
by: W. Ettlinger
SEC Consult Vulnerability Lab
https://www.sec-consult.com
=======================================================================

Vendor description:
-----------------------------
"eDirectory(TM) is a full-service, secure LDAP directory providing incredible
scalability and an agile platform to run your organization's identity
infrastructure and multi-platform network services."

URL: https://www.netiq.com/products/edirectory/

Business recommendation:
------------------------
An attacker without an account on the NetIQ eDirectory NDS iMonitor is able
to gain administrative access by luring an authenticated administrator to
visit an attacker-controlled web site. Moreover, an authenticated attacker
is able to retrieve internal data which potentially contains sensitive
data.

As the NetIQ eDirectory is often used to maintain a centralized user database
it is a very attractive target for an attacker. By compromising this system,
an attacker may be able to conduct further attacks on other systems.

SEC Consult recommends to immediately conduct a full security review of
this software, especially if used as a centralized user database.

Vulnerability overview/description:
-----------------------------------
1) Memory Disclosure (CVE-2014-5213)
Using crafted HTTP requests an administrative user can retrieve parts of the
virtual memory from the service. This potentially discloses secret data like
passwords.

2) Reflected Cross Site Scripting (XSS, CVE-2014-5212)
A reflected cross site scripting vulnerability was identified. An attacker
could take over the user account of a valid administrator.

Proof of concept:
-----------------
1) Memory Disclosure (CVE-2014-5213)
When accessing the following URL as an authenticated user, parts of the virtual
memory can be retrieved:

https://<host>:8030/nds/files/opt/novell/eDirectory/lib64/ndsimon/public
/images

2) Reflected Cross Site Scripting (XSS, CVE-2014-5212)
The following URL demonstrates a reflected XSS flaw:

https://<host>:8030/nds/search/data?scope=st&rdn=%3C/script%20%3E%3Cscri
pt%20%3Ealert%28%22XSS%22%29%3C/script%20%3E

Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in the NetIQ eDirectory NDS
iMonitor version 8.8 SP8, which was the most recent version at the time of
discovery.

Vendor contact timeline:
------------------------
2014-10-29: Contacting security (at) netiq (dot) com [email concealed], sending responsible disclosure
policy and PGP keys
2014-10-29: Vendor redirects to security (at) novell (dot) com [email concealed], providing PGP keys
through Novell support page
2014-10-30: Sending encrypted security advisory to Novell
2014-10-30: Novell acknowledges the receipt of the advisory
2014-11-18: Novell: the vulnerabilities have been fixed by development; the
patches will be release end of November
2014-12-08: Novell: the release has been pushed to Dec. 8th
2014-12-09: Novell: the release 8.8.8.4 should be released tomorrow;
The hotfix for 8.8.7.6 is still pending
2014-12-17: Verifying release of advisory; asking whether patches have been
released
2014-12-18: Novell: Patches have been released
2014-12-19: Coordinated release of security advisory

Solution:
---------
Update to the release 8.8.8.4 or apply fix for versions 8.8 SP 7.

Workaround:
-----------
No workaround available.

Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone: +43 1 8903043 0
Fax: +43 1 8903043 15

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

Interested to work with the experts of SEC Consult?
Write to career (at) sec-consult (dot) com [email concealed]

EOF W. Ettlinger / @2014

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJUk/lSAAoJEC0t17XG7og/GBQP/iSjNCW5dqU0kgTM9xrmrI2j
bBA8QCbXjUMhkD20BsCNXzbcwZjQOaVLrEblUC3nOPnjD8TRpZb5sWMiVz8Rw1MS
SId6lsMGDIdobT+YDMwPNM+uv77kyvUWFdLGR1A8SJP8NXEZ9lTRG9W/izB3LFoF
wwbYEIDHCxT96KvvL/YC+1YEVfLiv3V5ufpcBt7J6m6L018DrkGyFqTK+2+8O7pb
7un+LYqfVyotJM1XrmEjP569fquw9t2Pbybo2usX4vUJf9IHKWhthlVOezXqNxIa
YmlaYZsy9fy49TXubjB+SYBfe+JQBMijjwp/naIkV/93MGJUt45vhc9qyAt1BMFj
Q5cqr7ghCdYVua1QqGarDGvbiDGDaxZIOoOwVqCKZWU1AGEmcGeIS7xAjk1z/0W9
xYd4e7GgDh8eA2tpb0vquCjQSEmRZ9odP/At/kFULOzMfoE4H403XOfzhC3qj2R3
UTsP8N++R3ctrm2NIyEyFevBZ3PDMsWu35jgAJaFJ2KwuOiTqHWCOkenfA+8jqfN
URgRybQ4u+6HEaOomUeS0esayC34V1uOCjMQpnmXfW4FmX0pxj5GRl9BRDseVhOG
ZjAokjAnyS/8azSSw8amrJo/Wpii34KIof+WG5K5w1A+atpFtNquQFYlHLoS5zJX
DuoPZbC8Um/EtpC0zAv2
=UDJo
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus