Nokia IPSO Vulnerability

[Jonas Eriksson]

There is a remote security vulnerability in the Nokia IPSO operating
system.

Anyone with access to the webgui (Voyager) on the Nokia IP-box
can read any file on the system.

For example, login as the user 'monitor' (disabled by default)
and use the readfile.tcl to read any file:

http://x.x.x.x/cgi-bin/readfile.tcl?file=/etc/master.passwd

Tested on IPSO 3.6-FCS6


Regards,
Jonas Eriksson
http://sekure.net

[Damieon Stark]

On Thu, Apr 24, 2003 at 01:32:50PM -0300, Jorge Merlino wrote:
> I don't think that is a vulnerability.
> The file /etc/master.passwd has read access for all users. Monitor can also
> read it in a ssh session.
> I you try that URL in a file with, let's say, 660 permissions you get a
> blank page.

Ummm... What am I missing here? Does it seem _crazy_ to anybody else that
the permissions on the file containing some of the most sensitive information
on the system would have read access to all users? This is clearly NOT
the default on any of the BSD systems (including the one from which IPSO is
derived) that I am aware of.

Can anybody else confirm the permissions required to read the file? Can
anybody else confirm that the /etc/master.passwd file is a+r?

I would have to call this a vulnerability either way....

-visigoth

[Shawn Duffy]

I would agree that this isn't the best configuration and should probably
be changed, but I would like to know how many people are putting untrusted
user accounts on a Nokia box?

Shawn Duffy, CCNA CCSA
email: pakkit at codepiranha dot org
web: http://codepiranha.org/~pakkit
gpg key: http://codepiranha.org/~pakkit/pakkit.asc
gpg fpr: 8988 6FB6 3CFE FE6D 548E 98FB CCE9 6CA9 98FC 665A
having problems reading email from me? http://codepiranha.org/~pakkit/pgp-trouble.html


On Thu, 24 Apr 2003, Damieon Stark wrote:

> On Thu, Apr 24, 2003 at 01:32:50PM -0300, Jorge Merlino wrote:
> > I don't think that is a vulnerability.
> > The file /etc/master.passwd has read access for all users. Monitor can also
> > read it in a ssh session.
> > I you try that URL in a file with, let's say, 660 permissions you get a
> > blank page.
>
> Ummm... What am I missing here? Does it seem _crazy_ to anybody else that
> the permissions on the file containing some of the most sensitive information
> on the system would have read access to all users? This is clearly NOT
> the default on any of the BSD systems (including the one from which IPSO is
> derived) that I am aware of.
>
> Can anybody else confirm the permissions required to read the file? Can
> anybody else confirm that the /etc/master.passwd file is a+r?
>
> I would have to call this a vulnerability either way....
>
> -visigoth
>
>
>

[Jorge Merlino]

1) If a user enters the right password in the voyager login window she is
*authenticated to use the system* IMHO. Besides I don't think anyone
reasonable allows unrestricted access to the voyager web page from the
internet.

2) As I said before, that only works for a+r files, not every file on the
system.

Regards,
Jorge

-----Mensaje original-----
De: Valdis.Kletnieks@vt.edu [mailto:Valdis.Kletnieks@vt.edu]
Enviado el: Jueves, 24 de Abril de 2003 14:43
Para: Jorge Merlino
CC: bugtraq@securityfocus.com
Asunto: Re: Nokia IPSO Vulnerability


On Thu, 24 Apr 2003 13:32:50 -0300, Jorge Merlino <jmerlino@easynet.com.uy>
said:
> I don't think that is a vulnerability.
> The file /etc/master.passwd has read access for all users. Monitor can
also
> read it in a ssh session.

1) It being readable to all users *authorized to use the system* is
different
from it being readable to any bozo on the entire Internet.

2) /etc/master.password is used as a *Proof of Concept*. Feel free to
substitute any other file that might be more damaging to have. Hmm.. it
might be nice to snarf a copy of /etc/inetd.conf, see what's enabled.. or
maybe I want to grab a copy of.....

[Miller, Rick]

> Can anybody else confirm the permissions required to read the=20
> file? Can
> anybody else confirm that the /etc/master.passwd file is a+r?

I have few Nokia IP330s running IPSO 3.3-FCS3 and 3.4FCS4A, all of them =
have master.passwd perms being a+r

---
Rick Miller
Unix System Administrator
Cable & Wireless
(703) 673-4549

[Valdis.Kletnieks@vt.edu]

--==_Exmh_-1104527714P
Content-Type: text/plain; charset=us-ascii

On Thu, 24 Apr 2003 13:32:50 -0300, Jorge Merlino <jmerlino@easynet.com.uy> said:
> I don't think that is a vulnerability.
> The file /etc/master.passwd has read access for all users. Monitor can also
> read it in a ssh session.

1) It being readable to all users *authorized to use the system* is different
from it being readable to any bozo on the entire Internet.

2) /etc/master.password is used as a *Proof of Concept*. Feel free to
substitute any other file that might be more damaging to have. Hmm.. it
might be nice to snarf a copy of /etc/inetd.conf, see what's enabled.. or
maybe I want to grab a copy of.....



--==_Exmh_-1104527714P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQE+qCI5cC3lWbTT17ARAoL3AJ9H3GUEGcBi5IwOe4GXMe 8qqPP5kQCgn8JX
XFWCH2r7AuqowQpmpSK2wUo=
=1/Xw
-----END PGP SIGNATURE-----

--==_Exmh_-1104527714P--

Hi,
This is similar in effect to a previous so called vulnerability in =
IPSO.
The previous case was a buffer overflow on voyager -requiring- an =
authenticated=20
user.
It is true that master.passwd on other systems is (and should be in =
IPSO) mode 600.
In effect however, it is that you require authenticated (default =
disabled)access to=20
the box in the first place.. just to view it.=20

It is not advisable to chmod 600 it however if you are :

a) paranoid and dont trust your own authenticated users.

and/or=09

b) you dont want to use voyager.

Then go ahead, but voyager will not be usable (can't login).

Noone should allow access to untrusted or unauthenticated users to
their firewalls in the firstplace. Anyone who allows unrestricted =
access
to the web server from anywhere shouldn't be working in security IMHO.

The Nokia incident response team has been made aware of this issue and =
you
should expect a fix/patch shortly. Valdis, The most valuable file would
definatly have to be the initial, inetd.conf ... should be blank.

cheers,
Iain

-----Original Message-----
From: ext Jorge Merlino [mailto:jmerlino@easynet.com.uy]
Sent: 24 April, 2003 21:49
To: Valdis.Kletnieks@vt.edu
Subject: RE: Nokia IPSO Vulnerability=20


1) If a user enters the right password in the voyager login window she =
is
*authenticated to use the system* IMHO. Besides I don't think anyone
reasonable allows unrestricted access to the voyager web page from the
internet.

2) As I said before, that only works for a+r files, not every file on =
the
system.

Regards,
Jorge

-----Original Message-----
From: ext Valdis.Kletnieks@vt.edu [mailto:Valdis.Kletnieks@vt.edu]
Sent: 24 April, 2003 20:43
To: Jorge Merlino
Subject: Re: Nokia IPSO Vulnerability=20


On Thu, 24 Apr 2003 13:32:50 -0300, Jorge Merlino =
<jmerlino@easynet.com.uy> said:
> I don't think that is a vulnerability.
> The file /etc/master.passwd has read access for all users. Monitor can =
also
> read it in a ssh session.

1) It being readable to all users *authorized to use the system* is =
different
from it being readable to any bozo on the entire Internet.

2) /etc/master.password is used as a *Proof of Concept*. Feel free to
substitute any other file that might be more damaging to have. Hmm.. it
might be nice to snarf a copy of /etc/inetd.conf, see what's enabled.. =
or
maybe I want to grab a copy of.....


-----Original Message-----
From: ext Damieon Stark [mailto:visigoth@securitycentric.com]
Sent: 24 April, 2003 21:35
To: Jorge Merlino
Subject: Re: Nokia IPSO Vulnerability


On Thu, Apr 24, 2003 at 01:32:50PM -0300, Jorge Merlino wrote:
> I don't think that is a vulnerability.
> The file /etc/master.passwd has read access for all users. Monitor can =
also
> read it in a ssh session.
> I you try that URL in a file with, let's say, 660 permissions you get =
a
> blank page.

Ummm... What am I missing here? Does it seem _crazy_ to anybody else =
that
the permissions on the file containing some of the most sensitive =
information
on the system would have read access to all users? This is clearly NOT
the default on any of the BSD systems (including the one from which IPSO =
is
derived) that I am aware of.

Can anybody else confirm the permissions required to read the file? Can
anybody else confirm that the /etc/master.passwd file is a+r?

I would have to call this a vulnerability either way....

-visigoth