The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Neoteris IVE changepassword.cgi Authentication Bypass
------------------------------------------------------------------------
SUMMARY
<www.juniper.net> Neoteris Instant Virtual Extranet (IVE) is "a well
known 'clientless' SSL VPN solution for internal network remote access via
a standard web browser. It is widely used as an extranet portal for
corporate networks".
An attacker can exploit an authentication weakness in Neoteris IVE's
changepassword.cgi to brute force password of LDAP users configured on the
system.
DETAILS
Vulnerable Systems:
* Neoteris Instant Virtual Extranet (IVE) OS, Version 3.x Netories
Instant Virtual Extranet (IVE) OS, Version 4.x
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0939>
CAN-2004-0939
When a valid user tries to authenticate via the IVE and the password is
expired, the user will be asked to change their password and be directly
forwarded to the "changepassword.cgi" without asking for any form of
authentication. The username, authentication server and type will be
appended to the changepassword.cgi URL.
Since the changepassword.cgi allows the user to try the old password as
many times as they want, the unit effectively allows a brute force
password attack.
If an attacker were to obtain a username through various public
information gathering techniques, they could attempt to find an account
with a password that has expired and brute force that account to
eventually gain unauthorized access.
This vulnerability only affects IVE products that are configured with LDAP
or an NT domain authentication server. Other type of authentication
servers are not affected.
Vendor Status:
The vendor has released a patch and an advisory to address this issue. The
advisory is available the following location:
<http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach&txtAlertNumber=PSN-2004-08-25&viewMode=view>
http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach
&txtAlertNumber=PSN-2004-08-25&viewMode=view
ADDITIONAL INFORMATION
The original article can be found at:
<http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt>
http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
