bugtraq - Symantec FireWall/VPN Appliance model 200 leak of security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040216074949.32586.qmail@webmaildomini1.aruba.it>
Date: Mon, 16 Feb 2004 08:49:49 +0100
From: "Davide Del Vecchio" <dante@...ghieri.org>
To: bugtraq@...urityfocus.com
Subject: Symantec FireWall/VPN Appliance model 200 leak of security

============================================================
 Symantec FireWall/VPN Appliance model 200 leak of security
============================================================ 

Davide Del Vecchio Adv#9 

Discovered in: 15/01/2004
Date: 15/02/2004
Tested on FireWall/VPN Applicance model 200
Vendor notified. 

Description of the Appliance: 

 The FireWall/VPN Appliance 200 is an integrated security and
 networking device that provides easy secure, and cost-effective
 Internet connectivity between locations. With its all-in-one
 functionality, small businesses and remote offices can create
 a high-speed local network that enables secure access and
 interaction via the Internet with remote locations, business
 partners, and corporate networks. 

The problem: 

 Editing the password administration page, the password is in
 clear text. To access the administration page, you have to
 insert the admin psw, but your password will be cached in your
 pc and in every proxy server. It makes the Appliance NOT usefull
 to be managed remotely. 

Solution: 

 Contacted the Symantec Enterprise Support, they told me the "feature"
 is "by design", because of the HTTP connection instead of HTTPS, so
 it was NOT a bug (even if they did not know about it).
 My only statement was "adding vulns to vulns.. what about a java script?" 

Credits: 

 Davide Del Vecchio would like to thank all the people supporting him
 and his research, Diego Fuggetta, Gianluca Bellantuono, Filippo Sismondo,
 Carlo Martini, Giorgio Vitelli, Davide Zanella, his special sad friend
 Marcello Barnaba, finally but in primis his love that never leaves him 
alone. 

Happy Birthday to me. 

Disclaimer: 

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
^^^^^^^^ 

Please send suggestions, updates, and comments to:
Davide Del Vecchio , Dante Alighieri - dante at alighieri dot org
http://www.alighieri.org 

-- 
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Davide Del Vecchio "Dante Alighieri" dante (at) alighieri (dot) org
http://www.alighieri.org http://www.bluejack.it http://www.ezln.it
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -