D.Snezhkov
19/02/06, 01:13
Multiple security information disclosure paths and remote access
Netcool/NeuSecure Security information management platform .
Cleartext-storage of passwords in the configuration file
Cleartext reporting of user password in the log
Default backend Mysql database user and remote access.
Laxed filesystem permissions and id/password leak.
---------------------------------------------------------------------------=
-----------------------------------------------
Netcool/NeuSecure is a security information management (SIM) platform
designed to improve the effectiveness, efficiency and visibility of
security operations and information risk management. The solution
centralizes and stores security data from throughout the enterprise,
automating incident recognition and response, streamlining incident
handling, enabling policy monitoring enforcement and providing
comprehensive reporting for regulatory compliance. The centralization
and automation of these functions results in reduced costs of security
and IT operations
---------------------------------------------------------------------------=
------------------------------------------------------
=09=09Vendor communication history.
Feb 3 contacted customer.relations@micromuse.com asking to log a support c=
all.
=09was promptly redirected to support@micromuse.com
Feb 3 email explaining vulnerability sent to support@micromuse.com.
Prompt automated
=09response.
Feb 3 Ticket is opened with tag: Insufficient customer information.
Need customer id,
=09support contract number and environment description.
=09Due to the nature of this independent research, such
information is not available or cannot be provided to the support.
Feb 3 Second request for customer information in order to
successfully log the issue.
=09I stated one more time that any technical, non-customer related informat=
ion
=09can and will be provided.
Feb 6 Third request for customer information. And once more, I
explained the situation
=09willing to give any information not pertaining to the customer.
Ticket is downgraded
=09to lower priority.
Feb 16 Ticket is apparently closed. Disclosing to the list.
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++
Platform : RedHat EL 3
------------------------------------------------------------------
JReports-NeuSecure-3.0.236-1
common-NeuSecure-3.0.236-1
cms-NeuSecure-3.0.236-1
------------------------------------------------------------------
1. Default build has laxed directory permissions which may lead to
a regular user viewing configuration files containing passwords.
-rw-r--r-- 1 ns ns 1228 Feb 3 10:25 /etc/neusecure.conf
drwxr-xr-x 15 ns ns 4096 Dec 1 12:43 /opt/NeuSecure
drwxr-xr-x 2 ns ns 4096 Jan 9 21:42 /opt/NeuSecure/etc/
-rw-r--r-- 1 ns ns 1334 Nov 16 18:44
/opt/NeuSecure/etc/cms-3.0.236.buildconf
2. Cleartext-storage of passwords in the configuration file
/etc/neusecure.conf:
/etc/neusecure.conf
ORACLE_HOME=3D
CMS_DBHOST=3Dlocalhost
CMS_DBNAME=3Dxxx
CMS_DBUSER=3Dns
CMS_DBPASS=3Dnsl0ck
CMS_DBTYPE=3Dmysql
CMSM_DBHOST=3Dlocalhost
CMSM_DBNAME=3Dxxxxx
CMSM_DBUSER=3Dns
CMSM_DBPASS=3Dnsl0ck
FULL_REPORTS_STACKTRACE=3Dtrue
JAVA_HEAP_SIZE=3D-Xmx256M
AAM=3D1
VULN_MEM=3D256
###########################
# JReports Config Variables #
###########################
RPT_DBHOST=3Dreportserver
RPT_DBNAME=3Dxxxx
RPT_DBUSER=3Dns
RPT_DBPASS=3Dnsl0ck
RPT_DBTYPE=3Dmysql
#RPT_DBHOST
3. Cleartext reporting of the <ns> user password in the log viewable
by an unprivileged user which leads to direct mysql database
connection and authentication with possibility to dump users and
passwords from the 'auth' table:
-rw-rw-r-- 1 ns ns 5102 Jan 9 12:17
/opt/NeuSecure/./bin/ns_archiver.log
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++
Building NSSQLConnection "CMS Connection" type =3D mysql name =3D nsdbp
[1136830628.351]NSSQLConnection::NSSQLConnection =3D> building mysql
connection to: hostString =3D "/tmp/mysql.sock@nsdbp" user =3D "ns" pass =
=3D
"nsl0ck"
[1136830628.356]connected successfully!
[1136830628.356]Connected using UNIX socket:/tmp/mysql.sock
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++
trivial to connect to backend ....
Workaround:
-----------------------------------
Unfortunately, you cannot avoid storing cleartext passwords by
changing configuration
options. This should be reworked by the vendor.
Default password can be changed, but is still cleartext in the
configuration file.
1. Secure permissions to the password file to avoid unprivileged users
reading the file.
2. Redirect log storage to secure place, secure access permissions.
3. Change access permissions on the database
Dimitry Snezhkov.
Netcool/NeuSecure Security information management platform .
Cleartext-storage of passwords in the configuration file
Cleartext reporting of user password in the log
Default backend Mysql database user and remote access.
Laxed filesystem permissions and id/password leak.
---------------------------------------------------------------------------=
-----------------------------------------------
Netcool/NeuSecure is a security information management (SIM) platform
designed to improve the effectiveness, efficiency and visibility of
security operations and information risk management. The solution
centralizes and stores security data from throughout the enterprise,
automating incident recognition and response, streamlining incident
handling, enabling policy monitoring enforcement and providing
comprehensive reporting for regulatory compliance. The centralization
and automation of these functions results in reduced costs of security
and IT operations
---------------------------------------------------------------------------=
------------------------------------------------------
=09=09Vendor communication history.
Feb 3 contacted customer.relations@micromuse.com asking to log a support c=
all.
=09was promptly redirected to support@micromuse.com
Feb 3 email explaining vulnerability sent to support@micromuse.com.
Prompt automated
=09response.
Feb 3 Ticket is opened with tag: Insufficient customer information.
Need customer id,
=09support contract number and environment description.
=09Due to the nature of this independent research, such
information is not available or cannot be provided to the support.
Feb 3 Second request for customer information in order to
successfully log the issue.
=09I stated one more time that any technical, non-customer related informat=
ion
=09can and will be provided.
Feb 6 Third request for customer information. And once more, I
explained the situation
=09willing to give any information not pertaining to the customer.
Ticket is downgraded
=09to lower priority.
Feb 16 Ticket is apparently closed. Disclosing to the list.
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++
Platform : RedHat EL 3
------------------------------------------------------------------
JReports-NeuSecure-3.0.236-1
common-NeuSecure-3.0.236-1
cms-NeuSecure-3.0.236-1
------------------------------------------------------------------
1. Default build has laxed directory permissions which may lead to
a regular user viewing configuration files containing passwords.
-rw-r--r-- 1 ns ns 1228 Feb 3 10:25 /etc/neusecure.conf
drwxr-xr-x 15 ns ns 4096 Dec 1 12:43 /opt/NeuSecure
drwxr-xr-x 2 ns ns 4096 Jan 9 21:42 /opt/NeuSecure/etc/
-rw-r--r-- 1 ns ns 1334 Nov 16 18:44
/opt/NeuSecure/etc/cms-3.0.236.buildconf
2. Cleartext-storage of passwords in the configuration file
/etc/neusecure.conf:
/etc/neusecure.conf
ORACLE_HOME=3D
CMS_DBHOST=3Dlocalhost
CMS_DBNAME=3Dxxx
CMS_DBUSER=3Dns
CMS_DBPASS=3Dnsl0ck
CMS_DBTYPE=3Dmysql
CMSM_DBHOST=3Dlocalhost
CMSM_DBNAME=3Dxxxxx
CMSM_DBUSER=3Dns
CMSM_DBPASS=3Dnsl0ck
FULL_REPORTS_STACKTRACE=3Dtrue
JAVA_HEAP_SIZE=3D-Xmx256M
AAM=3D1
VULN_MEM=3D256
###########################
# JReports Config Variables #
###########################
RPT_DBHOST=3Dreportserver
RPT_DBNAME=3Dxxxx
RPT_DBUSER=3Dns
RPT_DBPASS=3Dnsl0ck
RPT_DBTYPE=3Dmysql
#RPT_DBHOST
3. Cleartext reporting of the <ns> user password in the log viewable
by an unprivileged user which leads to direct mysql database
connection and authentication with possibility to dump users and
passwords from the 'auth' table:
-rw-rw-r-- 1 ns ns 5102 Jan 9 12:17
/opt/NeuSecure/./bin/ns_archiver.log
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++
Building NSSQLConnection "CMS Connection" type =3D mysql name =3D nsdbp
[1136830628.351]NSSQLConnection::NSSQLConnection =3D> building mysql
connection to: hostString =3D "/tmp/mysql.sock@nsdbp" user =3D "ns" pass =
=3D
"nsl0ck"
[1136830628.356]connected successfully!
[1136830628.356]Connected using UNIX socket:/tmp/mysql.sock
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++
trivial to connect to backend ....
Workaround:
-----------------------------------
Unfortunately, you cannot avoid storing cleartext passwords by
changing configuration
options. This should be reworked by the vendor.
Default password can be changed, but is still cleartext in the
configuration file.
1. Secure permissions to the password file to avoid unprivileged users
reading the file.
2. Redirect log storage to secure place, secure access permissions.
3. Change access permissions on the database
Dimitry Snezhkov.