SECURITY ADVISORY - Level Platforms, Inc. Service Center Install Data HTTP Vulnerability
TECHSERVE, INC.
www.tech-serve.com
SECURITY ADVISORY
Advisory Name: Level Platforms, Inc. Service Center Install Data HTTP
Vulnerability
Release Date: 01/08/2008
Platform: Managed Workplace Service Center
Application: Version Number(s): 4.x, 5.x and 6.x
Severity: Ability to remotely determine version, build, service
pack, hot fix levels and times and dates each were installed
Author(s): Brook Powers, Sr. Network Engineer (bpowers@tech-serve
dot com)
Vendor Status: Vendor Notified February 1st, 2008
CVE Candidate: CVE-2008-0636
Reference: http://www.tech-serve.com/research/advisories/2008/
Overview:
=========
Level Platforms, Inc. (LPI) flagship product Managed Workplace Service
Center, which provides remote monitoring, reporting and alerting of
device & network status. The software is typically used by Managed
Service Providers and large IT departments. There is also a hosted
version offered through Ingram Micro.
LPI's software has two components, a Service Center (server) component,
and a Onsite Manager (client) component. The Service Center is typically
installed at a MSP's facility. The Service Center software sends &
receives data with one or more Onsite Manager software installations
(typically deployed at remote networks). The Service Center software
also provides a central console for management, monitoring, reporting
and alerting.
There exists at least one vulnerability in the Service Center software
that allows an attacker to remotely determine a wide variety of
potentially useful information via an HTTP URL.
Detailed Description:
=====================
A default install of the software handling the URL:
"http[s]://<SERVICE CENTER NAME>/About/SC_About.htm"
enumerates the following information without first checking to see if
the source of the command is authenticated (The <SERVICE CENTER NAME> is
the name that has been assigned to the Service Center website);
-Version
-Build
-Applied service packs
-Applied Hot Fixes
-The date and time each were installed.
Exploitation of this vulnerability provides an with attacker potentially
useful information that could be leveraged to attack the host, clients
or other resource to which they have access.
A Google search using the phrase "/About/SC_About.htm" enumerates
vulnerable systems.
No information has been provided to support any benefit achieved by
making this information publically available.
At this time, we are unaware of any other file permissions, cgi's or SQL
databases that do not verify submitted commands against authorized
users, however we believe it reasonable to assume others may exist. We
have not tested all versions or builds of the software, but have
reproduced the vulnerability in versions 4, 5 and 6.
A full audit of the software is in progress. Any additional security
risks, if discovered, will be made available publically, subsequent to
vendor notification.
Vendor Response:
================
This issue was reported to LPI by email on February 1, 2008.
On February 5, 2008 the following reply was received; "Thank you for
your input. I have forwarded this email over to our development team
for their consideration. Regards,..."
On February 6, 2008 the following reply was received; "...Our
development team is aware is this particular issue, and should be
addressing it, just want to let you know that having access to your
build/version number isn't hazardous to your managed services
business..."
Our Recommendation:
===================
1. There is no reason to give away the version/build number and every
reason to keep it confidential. Reduce the attack surface wherever
possible or practical.
2. Take steps to prevent publishing or exposing any unnecessary or
sensitive information that could be used to exploit your network.
3. Until the vulnerability is resolved by LPI;
a)prevent or restrict IP level access to the Service Center
website by restricting access to trusted IP ranges, or through VPN's.
Note that preventing Onsite Manager access
to the Service Center website will result in loss of functionality.
b)review the security settings of each web page within
Service Center.
c)disallow indexing of the Service Center site by search
engines using IP restrictions, robots.txt files or other measures
For more info, see:
===================
(Reserved for LPI advisory notice URL)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0636
Common Vulnerabilities and Exposures (CVE) Information:
=======================================================
The Common Vulnerabilities and Exposures (CVE) project, sponsored by the
U.S. Department of Homeland Security, National Cyber Security Division,
has assigned the following name(s) to these issues;
CVE-2008-0636
These are candidates for inclusion in the CVE list
(http://cve.mitre.org), which standardizes names for security issues.
Copyright 2008 Techserve, Inc. - All rights reserved.
End