‘IBM Proventia Mail Security System Insecure Direct Object Reference Vulnerability’

Summary

An Insecure Direct Object Reference vulnerability was discovered in IBM Proventia Mail Security System.’

Credit:

‘The information has been provided by Marian Ventuneac.
The original article can be found at: http://seclists.org/bugtraq/2010/Sep/84


Details

Vulnerable Systems:
 * IBM Proventia Network Mail Security System – virtual appliance (firmware 1.6)

Immune Systems:
 * IBM Proventia Network Mail Security System firmware 2.5 or later.

The Web-based Local Management Interface (LMI) of IBM Proventia Network Mail Security System appliance (firmware 1.6) is vulnerable to an Insecure Direct Object Reference vulnerability. When exploited by an authenticated attacker, such vulnerability could lead to compromising the security of the appliance, allowing OS command execution, local file inclusion resulting in exposure of appliance configuration files, source code, etc.

The affected resource is not part of the IBM PNMSS firmware 2.5.By manipulating the l parameter of /sla/index.php resource, an authenticated attacker can perform any of the above attacks. The following test case can be used to expose internal system configuration for PHP engine:

url_placeholder/sla/index.php?l=/../../../../../../../../etc/php.ini

CVE Information:
CVE-2010-0154

Disclosure Timeline:
2009, November 07: Vulnerabilities discovered and documented
2009, November 08: Notification sent to IBM
2010, September 12: MVSA-10-008 advisory published.’

Categories: News