EMC Navisphere Manager Directory Traversal Vulnerability iDEFENSE Security Advisory 08.05.05 www.idefense.com/application/poi/display?id=288&type=vulnerabilities August 05, 2005 I. BACKGROUND EMC Navisphere storage management software is a suite of tools that enables discovery, monitoring, provisioning, and reporting on EMC CLARiiON FC4700 Storage Systems. II. DESCRIPTION Remote exploitation a directory traversal vulnerability in EMC Corp. Navisphere Manager could allow an attacker to retrieve arbitrary files from the system running Navisphere Manager as well as retrieve directory listings. The vulnerability specifically exists due to a lack of validation of HTTP requests. The following request can be used to retrieve the Navisphere Manager log file, which often contains the administrative password in plaintext: http://vulnerable/../../../../../../../EMC/NAVISPHERE/common/log/navimon .log Another flaw allows a user to list the contents of arbitrary directories by simply appending a '.' to the end of a request. The following request will list the contents of the server root: http://vulnerable/. III. ANALYSIS Successful exploitation allows remote attackers to gain access to files on the target system; in some cases, it is possible to retrieve the Clarion Administrator password by viewing log files. IV. DETECTION Navisphere Manager Base 6.4.1.0.0 is reportedly vulnerable. V. WORKAROUND Limit access to the Navisphere Manager server to only trusted hosts. Since the Manager runs on TCP port 80, apply filters where possible. VI. VENDOR RESPONSE "The vulnerability identified is found in older versions of Navisphere Management Server (r), for which an update has been issued. In these updated versions, HTTP validation is implemented. Attempts to traverse the file system by way of a URL (e.g., "../../..") are detected and such requests are rejected with the following error: 'The page cannot be displayed' Customers running Navisphere Manager Version 6.4, 6.5, or 6.6 who do not have the following revisions (or higher) should contact their authorized EMC Service representative: 6.6.0.5.0 Management Server 6.6.0.5.0 Management Server Base 6.6.0.5.0 Windows Management Server 6.5.4.0.0 Management Server 6.5.4.0.0 Management Server Base 6.5.4.0.0 Windows Management Server 6.4.8.0.0 Management Server 6.4.8.0.0 Management Server Base 6.4.8.0.0 Windows Management Server Later revisions of Navisphere Management Server that come bundled with the FLARE Operating Environment (FOE) already contain this fix, starting with FLARE 14 (rev 02.07) released in June 2004." VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-2357 to the "../" issue and CAN-2005-2358 to the trailing dot issue. These are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/19/2005 Initial vendor notification 05/05/2005 Initial vendor response 08/05/2005 Coordinated public disclosure IX. CREDIT The discoverer of this vulnerability wishes to remain anonymous. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@private for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
This archive was generated by hypermail 2.1.3 : Fri Aug 05 2005 - 15:27:43 PDT