Privileg escalation in Omegasoft Insel 7
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Privileg escalation in Omegasoft Insel 7
- From: "MC Iglo" <mc.iglo@xxxxxxxxxxxxxx>
- Date: Wed, 9 Jan 2008 15:52:16 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=CHzp4yEVu3m8u/vKJoGzYecuiGBxJ7Zl3CbGQ/gGiYI=; b=oT3tvTOvtH0GEKtYnGiX/6LxWft0WFh7KVby7rKGMoqJrW58h2P9hSPJQ1DUgyr2P3z2yzdRVlLDmNvFi1KjTDQzQeroSOS0EwbitHUAeNxMoXN45j4LRy8og8AXWUOgsZSOthfINWYNjfoi5Vh0mjHOaGrH5spz5kWzBXCfLuY=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=ChLwSYtrBW8dre9GvRg8DZbdY1MuyKb7cny93DkfSO2M8pEg/hNv4UR61wSR8AS1vbFzcUBosGN3egsm6bOl/MGbaRxyRjsirjOikaQYlZKC1lIyMHQ5kXvtF/QnDAOXFg6vxaWLIxem3/aH2+y/IKJ5hYv9eRVQjO7ckvXisvE=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Hi list,
Omegasoft's Insel 7 stores Cookies on your computer for identifying
the logged-in user.
As these Cookies do not contain any password hash but only the
username and some meaningless stuff you can easily get into the system
with another login.
this gets even more easy, as there is a conclusive error message on
failed login attempt.
If the user exists, you get a wrong password message.
It is possible to enumerate the users.
together, you can sign on as any user u want to without knowing the password.
Cookiename: OMEGALogon
value:
[MANDATOR]%7C[CUSTOMERNUMBER]%7C[USERID]%7C%7CArial%7CArial%7C%2D%2D%2D%2D%2D%2D%7C[SURNAME]%2C+[NAME]%7C%7C%7C[LASTLOGINTIME]%7C
Cookiename: OMEGA[MANDATOR]
value: [USERID]%7C[CUSTOMERNUMBER]%7[HOST]%7C[DATE]%7C
Regards
MC.Iglo