The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
APG Classmaster Weak Permissions
------------------------------------------------------------------------
SUMMARY
<http://www.apgtechnology.co.uk/classmaster/classmaster.htm> APG
ClassMaster is "Edutec s Educational Networking Solution, that delivers
unrivalled levels of usability and functionality to classroom networks.
With its powerful tools and simple user friendly interface, ClassMaster
minimizes the administration load on teachers and network managing staff
alike, it turns ICT into a powerful teaching tool and enhances the
experience of using ICT for all concerned."
Access to APG's Classmaster subfolders is not properly limited, allowing
access to shares with full permissions over a LAN.
DETAILS
This vulnerability affects all APG Classmaster Workstation versions. It
remains a problem as an attacker can access shares with full permissions
over a LAN.
An attackers needs to issue a simple command in an MSDOS prompt (using the
net windows application), mapping an account to a specified drive, as
below:
net use [drive]: \\[server]\[user]$
A 'dir' command at this stage gives an access denied error. Knowing the
name of the files area (which will be the same for each user) can lead to
changing directory to that folder.
cd 'My files'
An attacker now has full permissions on a selected users 'my files' area.
ADDITIONAL INFORMATION
The information has been provided by <mailto:alex_@_exploitthissite.org>
Alex Garrett.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
