Marc Ruef
18/01/05, 22:25
=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear ladies and gentlemen
We have found a potential security vulnerability in the Netegrity =
SiteMinder script smpwservicescgi.exe. If a user is connecting to a =
secured web server over an url like https://www.scip.ch (just an example =
with our domain) he will get forwarded to the logon url =
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TYPE=3D3256=
4432&REALMOID=3D02-0005b182-32f3-2121-ab24-8350cdfdaf3b&GUID=3D&SMAUTHREA=
SON=3D0&METHOD=3DGET&SMAGENTNAME=3D$SM$5rR6TLmkLOjh8Qac1FGeB5OHEA63VfWp Qj=
t0OYda1BBrydPC0NKSWg%3d%3d&TARGET=3D$SM$https%3a%2f%2fwww%2escip%2ech%2fi=
ntern%2ehtml - In this url string several data is prepared to be =
processed as $QUERY_STRING in a common form http get request. As you can =
see, the last variant is named TARGET. This specifies the target url =
after authentication. In the example the url =
https://www.scip.ch/internal.html
The problem is, that a malicous user may use this to realize a social =
hacking or phishing attack. He may define a malicous web site as target =
to forward to another web site with unrelated content (e.g. porn), a =
cross site scripting or more severe vulnerability (e.g. JPEG exploit). =
The lack of reputation or launching another attack may be possible. It =
is also possible to shorten the malicous url to =
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=3Dht=
tp%3a%2f%2fwww%2ecomputec%2ech - This is ideal to put it into a phishing =
mail. You find the original advisory, written in german, on =
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3D1022 (Netegrity =
SiteMinder Login TARGET-Weiterleitung Designfehler).
We have not found any information on that issue. So I sent this =
information (nearly the same posting) on 14/12/04 to =
info-emea@netegrity.com and asked for a solution. As I haven't heard =
_anything_ until 23/12/04 I sent a reminder email. Due no reply came =
back we made this vulnerability public finally to force Netegrity to =
react on this case. An Attack Tool Kit (ATK) plugin that addresses this =
vulnerability will be published in the next days[1].
Regards,
Marc Ruef
[1] http://www.computec.ch/projekte/atk/
- --=20
) scip AG (
Technoparkstr. 1
8005 Z=FCrich
T +41 1 445 18 18=20
F +41 1 445 18 19
maru@scip.ch
www.scip.ch
- - Aktuellste IT-Sicherheitsluecken -
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: http://www.scip.ch
iQA/AwUBQevrDhe5hzJzqVMhEQLX8QCeNnfaNUTqAlkNqF49dV/jyTFwuBoAn3UG
KAjYMXWByPzqHfyzGxw7dlHw
=3Deo/G
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear ladies and gentlemen
We have found a potential security vulnerability in the Netegrity =
SiteMinder script smpwservicescgi.exe. If a user is connecting to a =
secured web server over an url like https://www.scip.ch (just an example =
with our domain) he will get forwarded to the logon url =
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TYPE=3D3256=
4432&REALMOID=3D02-0005b182-32f3-2121-ab24-8350cdfdaf3b&GUID=3D&SMAUTHREA=
SON=3D0&METHOD=3DGET&SMAGENTNAME=3D$SM$5rR6TLmkLOjh8Qac1FGeB5OHEA63VfWp Qj=
t0OYda1BBrydPC0NKSWg%3d%3d&TARGET=3D$SM$https%3a%2f%2fwww%2escip%2ech%2fi=
ntern%2ehtml - In this url string several data is prepared to be =
processed as $QUERY_STRING in a common form http get request. As you can =
see, the last variant is named TARGET. This specifies the target url =
after authentication. In the example the url =
https://www.scip.ch/internal.html
The problem is, that a malicous user may use this to realize a social =
hacking or phishing attack. He may define a malicous web site as target =
to forward to another web site with unrelated content (e.g. porn), a =
cross site scripting or more severe vulnerability (e.g. JPEG exploit). =
The lack of reputation or launching another attack may be possible. It =
is also possible to shorten the malicous url to =
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=3Dht=
tp%3a%2f%2fwww%2ecomputec%2ech - This is ideal to put it into a phishing =
mail. You find the original advisory, written in german, on =
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3D1022 (Netegrity =
SiteMinder Login TARGET-Weiterleitung Designfehler).
We have not found any information on that issue. So I sent this =
information (nearly the same posting) on 14/12/04 to =
info-emea@netegrity.com and asked for a solution. As I haven't heard =
_anything_ until 23/12/04 I sent a reminder email. Due no reply came =
back we made this vulnerability public finally to force Netegrity to =
react on this case. An Attack Tool Kit (ATK) plugin that addresses this =
vulnerability will be published in the next days[1].
Regards,
Marc Ruef
[1] http://www.computec.ch/projekte/atk/
- --=20
) scip AG (
Technoparkstr. 1
8005 Z=FCrich
T +41 1 445 18 18=20
F +41 1 445 18 19
maru@scip.ch
www.scip.ch
- - Aktuellste IT-Sicherheitsluecken -
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: http://www.scip.ch
iQA/AwUBQevrDhe5hzJzqVMhEQLX8QCeNnfaNUTqAlkNqF49dV/jyTFwuBoAn3UG
KAjYMXWByPzqHfyzGxw7dlHw
=3Deo/G
-----END PGP SIGNATURE-----