[Gosecure Adivsory] Neoteris IVE Vulnerability
Gosecure Advisory
http://www.gosecure.ca
Neoteris IVE changepassword.cgi Authentication Bypass
Date Published: 2004-09-20
Date Discovered: 2004-07-23
Advisory ID: GOSECURE-2004-10
Class: Design Error
Risk: Medium
Vendor: Juniper Networks
www.juniper.net
Advisory URL:
http://www.gosecure.ca/SecInfo/gosecure-2004-10.txt
Affected System:
Neoteris Instant Virtual Extranet (IVE) OS, Version 3.x
Netories Instant Virtual Extranet (IVE) OS, Version 4.x
Description:
Neoteris Instant Virtual Extranet (IVE) is a well known "clientless" SSL VPN
solution for internal network remote access via standard web browser. It is
widely used as an extranet portal for corporate network.
There is a vulnerability in Neoteris IVE password management.
When a valid user tries to authenticate via Neoteris and the password is
expired, the user will be directly forwarded to "changepassword.cgi" without
asking any form of authentication. The username, authentication server and type
will be appended to ?changepassword.cgi? URL. Since the "changepassword.cgi"
allows the user to try the old password as many times as they want, effectively
allowing brute force password attack. By using the trivial information
gathering skills to get the valid accounts and launching brute force attack, a
remote attacker may take over the password expired accounts and gain
unauthorized access to the internal network resource.
This vulnerability only affects the IVE products which are configured with an
LDAP or NT domain authentication server. Other type of authentication servers
are not affected.
Solution:
Vendor has released a patch and an advisory to address to this vulnerability.
The advisory is available the following location:
http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Seach&txtAlertNumber=PSN-2004-08-25&viewMode=view
Credits:
The vulnerability was found by Jian Hui Wang from Team Gosecure. Great thank to
Robert Masse for his support to this issue.
Copyright (c) 2002-2004 GoSecure.Inc
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express consent of
Gosecure. If you wish to reprint the whole or any part of this alert
in any other medium excluding electronic medium, please email info@xxxxxxxxxxx
for permission.
Disclaimer
The information within this advisory may change without notice. There are no
warranties, implied or express, with regard to this information. In no event
shall the author be liable for any direct or indirect damages
whatever arising out or in connection with the use or spread of this
information. Any use of this information is at the user's own risk.