bugtraq - Airmagnet management interfaces multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004001c6f2be$5004d5c0$466f6f0a@offwork>
Date: Wed, 18 Oct 2006 18:04:22 +0400
From: noreply@...ecurity.ru
To: <bugtraq@...urityfocus.com>
Subject: Airmagnet management interfaces multiple vulnerabilities

Airmagnet management interfaces multiple vulnerabilities

A management interface of AirMagnet Enterprise contains several middle-risk 
vulnerabilities. Vulnerabilities ranges from reflected and stored Cross-Site 
scripting to remote code execution and protection bypass.

Smart Sensor Edge Sensor

Reflected (non persistent) XSS in 404 error page.
Stored (persistent) XSS in log viewer via user name in failed logon record.

Enterprise Server Web-interface stored XSS

AirMagnet Enterprise Server provides feature which can be used to check 
server status via https (Enterprise Server Status Overview). One of the 
pages (ACL) displays monitored APs status. SSID of AP echoed to the user 
browser without screening which can lead to XSS conditions.

AirMagnet Enterprise console and Remote Sensor console (Laptop) XAS

AirMagnet AirWISE feature provide detailed description of detected attacks. 
. AirMagnet console uses for displaying information about an intrusion 
embedded Internet Explorer object and inserts in the HTML template SSID of 
access points (or the client) without screening.

AirMagnet Enterprise console SSL mitm attack

AirMagnet Enterprise console don't validate Enterprise Server certificate, 
which can be used by attacker who can realize mitm condition between Server 
and Console to decrypt traffic and sniff administrator and sensors 
passwords.

DISCLOSURE TIMELINE

May - September 2006 - Attempts to contact vendor without intelligible 
response.
18 October 2006 - Public disclosure