The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Netegrity SiteMinder smpwservicescgi.exe Target Redirection
------------------------------------------------------------------------
SUMMARY
<http://www.netegrity.com/products/products_SM_overview.cfm> Netegrity
SiteMinder enables "companies to administer and consistently enforce user
access to Web applications and by providing single sign-on (SSO) services
to users".
Due to improper filtering of user provided data, a remote attacker can
cause the Netegrity SiteMinder's smpwservicescgi.exe CGI to redirect a
user to a third party site, which in turn can be used in phishing attacks.
DETAILS
Netegrity's SiteMinder has a CGI called smpservicecgi.exe, which is used
to authenticate a user prior to allowing him to access a restricted web
page. One of this CGI's parameters allow the redirection of the user to a
web site once the authentication process has been successful. This
parameter however, does not check to which web site the user is
redirected. This allows an attacker to redirect the user to whatever site
he desires, while the user thinks this is the natural course of the logon
process.
Exploit:
The following URL will illustrate the attack, once the user has
successfully/unsuccessfully logged on he will be redirected to the
http://www.google.com web site:
http://vulnerable/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=http%3a%2f%2fwww%2google%2eccom
ADDITIONAL INFORMATION
The information has been provided by <mailto:maru@scip.ch> Marc Ruef.
The original article can be found at:
<http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022>
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
