lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7CD77D0C2B0C6141A928C5F5DC97C4C00650E4@ukwtm201>
Date: Wed, 18 Jun 2003 09:21:59 +0100
From: "Brewis, Mark" <mark.brewis@....com>
To: "'bugtraq@...urityfocus.com'" <bugtraq@...urityfocus.com>
Subject: Resolution of Issue - Compaq Insight Manager - related to Bugtraq
	 ID 2500


Following considerable investigations by the HP Team responsible for the
CIM Agents component in Compaq Insight Manager, it has been agreed that this
is not
an issue with CIM, and I am happy to state that this bugtraq post, regarding
ftp over CIM, should be withdrawn.

A combination of testing architecture, and the ability of Internet Explorer
to ignore any specific proxy settings entered in Tools > Internet Options >
Connections > LAN Settings > Proxy server if a connection cannot be made,
and to then attempt to connect to the target over the local LAN, caused a
false-positive result.

The post on http proxying is still valid.  All old, vulnerable versions of
CIM should be patched for the http proxy vulnerability, following the
recommendations from Compaq, or more preferably, updated for a far more
secure version of CIM.  All recent versions of CIM are not vulnerable to
this issue.
 
Many thanks to Chris Hibbard and the IM7 QA team for their efforts in
resolving this issue.

If anyone wants more information about this, feel free to drop me a line.

-----Original Message-----
From: Brewis, Mark 
Sent: Wednesday, May 21, 2003 6:40 PM
To: 'bugtraq@...urityfocus.com'
Subject: Compaq Insight Manager - related to Bugtraq ID 2500 


Another one out of the back catalogue, seen again today.

Version:

Compaq Insight Manager Version 5.0 or below

Issue:

The Proxy vulnerability identified in Bugtraq ID 2500, and the patch
produced by Compaq for that vuln. does not prevent ftp proxying.

On a host denying http proxying, it is possible to ftp over http to a third
party host, using CIM as the proxy.  You can't put or get (probably because
there isn't an ftp server on CIM to buffer the transfer), but you can
browse, allowing for a targeted attack.


Again, I talked to Compaq about this over a year ago, and they appeared to
work on the principle that the problem went away in the newest version of
CIM.  I'd forgotten about it until today, when I saw  a CIM/CMA installation
again.

Advice - keep upgrading and patching, or stop using CIM.

Mark Brewis

Security Consultant
EDS
Information Assurance Group
Wavendon Tower
Milton Keynes
Buckinghamshire
MK17 8LX.

Tel:	+44 (0)1908 28 4234/4013
Fax:	+44 (0)1908 28 4393
E@:	mark.brewis@....com

This email is confidential and intended solely for the use of the
individual(s) to whom it is addressed. Any views or opinions presented are
solely those of the author.  If you are not the intended recipient, be
advised that you have received this email in error and that any use,
dissemination, forwarding, printing, or copying of this mail is strictly
prohibited.

Precautions have been taken to minimise the risk of transmitting software
viruses, but you must carry out your own virus checks on any attachment to
this message. No liability can be accepted for any loss or damage caused by
software viruses.


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ