bugtraq - APC Management Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 29 Nov 2007 14:41:38 -0000
From: garys@...alserversolutions.com
To: bugtraq@...urityfocus.com
Subject: APC Management Vulnerability

We have found a security exploit in the latest APC firmware versions for there switched rack PDU products. We have only tested this against the version listed below on a AP7932 0u 30amp PDU.

Name: 	rpdu
Version: 	v3.5.5
Date: 	07/18/2007
Time: 	11:38:29

Name: 	aos
Version: 	v3.5.6
Date: 	07/18/2007
Time: 	10:24:55
Date Reported to APC: 11-28-2007

Discovered by: 
Gary Simat of Total Server Solutions LLC
Randy Kent of Sevaa Group Inc

Steps to reproduce:
1) login to the APC as a user from computer 1
2) Then attempt to login from another computer (we will call this computer 2), the User Name and Password will not be editable, so just click Log On. It will say someone is already logged in. leave this page up.
3) logout of computer 1
4) simply hit refresh on computer 2 and select to resend the headers. you will be logged in as the previously authenticated user.