<<< Date Index >>>     <<< Thread Index >>>

DDIVRT-2007-04 NetSupport Manager Authentication Bypass



Title
-----
NetSupport Manager Authentication Bypass

Severity
--------
High

Date Discovered
---------------
9/4/2007

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Additional Discovered By (Digital Defense, Inc.  Credit: sxkeebler and r@b13s

Vulnerability Description
-------------------------
The NetSupport Manager client that listens on TCP port 5405 does not properly 
handle authentication sessions.  It is possible to pose as the NetSupport 
Manager, associate to a client, and then issue commands without performing the 
authentication sequence.  Both the basic and advanced authentication schemes 
can be bypassed in the same manner.  When properly exploited, this flaw will 
results in a complete compromise of the target system.  

Solution Description
--------------------
Digital Defense, Inc. notified NetSupport on September 9, 2007 of this flaw but 
did not receive any response or acknowledgement from the vendor.  However, 
NetSupport has released a patch for this flaw as described by NetSupport 
Technical Document ID TD543.  

Tested Systems / Software (with versions)
-----------------------------------------
NetSupport Manager 10.20 running on Windows XP SP2 and Windows 2K3 SP2.  

NetSupport acknowledges in Technical Document ID TD543 that the following 
versions of the NetSupport Manager are vulnerable to this flaw:

NSM 5.00, NSM 5.01, NSM 5.02, NSM 5.02f1, NSM 5.03, NSM 5.05, NSM 5.30, NSM 
5.31, NSM 6.00, NSM 6.10, NSM 6.11, NSM 7.01, NSM 7.10, NSM 8.00, NSM 8.10, NSM 
9.00, NSM 8.50, NSM 8.60, NSM 9.10, NSM 9.50, NSM 9.60, NSM 10.00, NSM 10.20

Vendor Contact
--------------
NetSupport
http://www.netsupportmanager.com/