lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070115165725.8413.qmail@webmaild.fe1.aruba.it>
Date: Mon, 15 Jan 2007 17:57:25 +0100
From: "Davide Del Vecchio" <dante@...ghieri.org>
To: bugtraq@...urityfocus.com
Subject: Remedy Action Request System 5.01.02 - User Enumeration

=======================================================
 Remedy Action Request System User Enumeration
======================================================= 

Davide Del Vecchio Adv#11 

Discovered in: 08/01/2007 

Version affected: Remedy Action Request System 5.01.02 Patch 1267.
The same vulnerable code could be present in other versions. 

Reference: http://www.alighieri.org/advisories/advisory-remedy50102.txt 

Software description: 

 From BMC Software website:
 "Remedy Action Request System 5.01.02 provides a consolidated Service
 Process Management platform for automating and managing Service
 Management business processes."
 

The problem: 

 During user login phase, it is possible to enumerate existing users
 examining the error messages provided by the software. 

 Suppling a non-existing user the error message is: 


 ARERR [612] No such user is registered with this server
	user: test,  server: 10.10.10.11 

 Unable to successfully log in to any server. 


 Suppling an existing user the error message is: 


 ARERR [329] Invalid password for an existing user
	user: user,  server: 10.10.10.11 

 Unable to successfully log in to any server. 


Solution: 

 Vendor has been contacted 3 times with no answer. 


Credits: 

 Davide Del Vecchio would like to thank his family and all
 the people supporting him and his research.
 Support the rosewitch project. 


Disclaimer: 

 The information within this paper may change without notice. Use of this
 information constitutes acceptance for use in an AS IS condition.
 There are NO warranties with regard to this information. In no event shall
 the author be liable for any damages whatsoever arising out of or in
 connection with the use or spread of this information. Any use of this
 information is at the user's own risk.
 ^^^^^^^^ 

Please send suggestions, updates, and comments to:
Davide Del Vecchio "Dante Alighieri" - dante at alighieri dot org
http://www.alighieri.org ~ http://legaest.blogspot.com

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ