Hi! This is the ezmlm program. I'm managing the
bugtraq@securityfocus.com mailing list.

I'm working for my owner, who can be reached
at bugtraq-owner@securityfocus.com.

Messages to you from the bugtraq mailing list seem to
have been bouncing. I've attached a copy of the first bounce
message I received.

If this message bounces too, I will send you a probe. If the probe bounces,
I will remove your address from the bugtraq mailing list,
without further notice.

I've kept a list of which messages from the bugtraq mailing list have
bounced from your address.

Copies of these messages may be in the archive.

To retrieve a set of messages 123-145 (a maximum of 100 per request),
send an empty message to:
<bugtraq-get.123_145@securityfocus.com>

To receive a subject and author list for the last 100 or so messages,
send an empty message to:
<bugtraq-index@securityfocus.com>

Here are the message numbers:

23560
23557
23561
23539
23559
23538
23564
23540
23563
23562
23566
23556
23558
23568
--- Enclosed is a copy of the bounce message I received.
Return-Path: <>
Received: (qmail 5924 invoked from network); 22 Feb 2006 10:58:49 -0000
Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26)
by lists2.securityfocus.com with SMTP; 22 Feb 2006 10:58:49 -0000
Received: from mail.securityfocus.com (mail.securityfocus.com [205.206.231.9])
by outgoing2.securityfocus.com (Postfix) with SMTP id 75DF0162AA0
for <bugtraq-return-23560-bugtraq=freebsd.csie.nctu.edu.tw@lists2.securityfo cus.com>; Wed, 22 Feb 2006 09:54:34 -0700 (MST)
Received: (qmail 31347 invoked by alias); 22 Feb 2006 17:23:31 -0000
Received: (qmail 31341 invoked from network); 22 Feb 2006 17:23:30 -0000
Received: from freebsd.csie.nctu.edu.tw (140.113.17.209)
by mail.securityfocus.com with SMTP; 22 Feb 2006 17:23:30 -0000
Received: from freebsd.csie.nctu.edu.tw ([140.113.17.209]) by freebsd.csie.nctu.edu.tw
via smtpd (for mail.securityfocus.com [205.206.231.9]) with ESMTP; Wed, 22 Feb 2006 09:13:18 -0800
Received: by FreeBSD.csie.nctu.edu.tw (Postfix)
id D5A6E7E9CA; Thu, 23 Feb 2006 01:39:14 +0800 (CST)
Date: Thu, 23 Feb 2006 01:39:14 +0800 (CST)
From: MAILER-DAEMON@FreeBSD.csie.nctu.edu.tw (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bugtraq-return-23560-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="A13407E9CD.1140629954/FreeBSD.csie.nctu.edu.tw"
Message-Id: <20060222173914.D5A6E7E9CA@FreeBSD.csie.nctu.edu.t w>

This is a MIME-encapsulated message.

--A13407E9CD.1140629954/FreeBSD.csie.nctu.edu.tw
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host FreeBSD.csie.nctu.edu.tw.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<bugtraq@freebsd.csie.nctu.edu.tw>: Command died with status 1:
"/usr/local/news/bin/mail-post.pl mailing.unix.bugtraq"

--A13407E9CD.1140629954/FreeBSD.csie.nctu.edu.tw
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; FreeBSD.csie.nctu.edu.tw
X-Postfix-Queue-ID: A13407E9CD
X-Postfix-Sender: rfc822; bugtraq-return-23560-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
Arrival-Date: Thu, 23 Feb 2006 01:39:13 +0800 (CST)

Final-Recipient: rfc822; bugtraq@freebsd.csie.nctu.edu.tw
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; Command died with status 1:
"/usr/local/news/bin/mail-post.pl mailing.unix.bugtraq"

--A13407E9CD.1140629954/FreeBSD.csie.nctu.edu.tw
Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from localhost (localhost.csie.nctu.edu.tw [127.0.0.1])
by FreeBSD.csie.nctu.edu.tw (Postfix) with ESMTP id A13407E9CD
for <bugtraq@freebsd.csie.nctu.edu.tw>; Thu, 23 Feb 2006 01:39:13 +0800 (CST)
Received: from FreeBSD.csie.nctu.edu.tw ([127.0.0.1])
by localhost (FreeBSD.csie.nctu.edu.tw [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 26044-02 for <bugtraq@freebsd.csie.nctu.edu.tw>;
Thu, 23 Feb 2006 01:39:13 +0800 (CST)
Received: from outgoing.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by FreeBSD.csie.nctu.edu.tw (Postfix) with ESMTP id 93CAD7E9CA
for <bugtraq@freebsd.csie.nctu.edu.tw>; Thu, 23 Feb 2006 01:39:11 +0800 (CST)
Received: from outgoing.securityfocus.com by outgoing.securityfocus.com
via smtpd (for freebsd.csie.nctu.edu.tw [140.113.17.209]) with ESMTP; Wed, 22 Feb 2006 09:13:14 -0800
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 9B80B236F44; Wed, 22 Feb 2006 09:49:24 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 25531 invoked from network); 22 Feb 2006 06:21:46 -0000
Reply-To: <advisories@irmplc.com>
From: "Advisories" <advisories@irmplc.com>
To: <bugtraq@securityfocus.com>
Subject: IRM 017: Multiple Vulnerabilities in Infovista Portal SE
Date: Wed, 22 Feb 2006 13:02:46 -0000
Message-ID: <008301c637b0$46dba790$660019ac@test.irmplc.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Thread-Index: AcY3sEaj/IiIBIc8T0uf540ZBeKKFQ==

----------------------------------------------------------------------
IRM Security Advisory No. 017

Multiple Vulnerabilities in Infovista Portal SE

Vulnerability Type / Importance: Directory Traversal / High
Information Leakage / Low

Problem Discovered: January 20th 2006
Vendor Contacted: January 20th 2006
Advisory Published: February 22nd 2006
----------------------------------------------------------------------

Abstract:

VistaPortal enables secure, browser-based access to service-centric
performance information. The easy implementation, display and design of
Portal-based dashboards and reports give accurate visibility into the
performance of the entire global IT infrastructure. VistaPortal allows users
to simultaneously view Key Performance Indicators (KPIs), real-time
performance notifications and strategic business information, from which
users can drill down to related real-time and historical reports residing in
VistaMart, the InfoVista Server and VistaTroubleshooter. VistaPortal
delivers rich, interactive content within a standards-based, open
architecture that allows seamless integration with existing applications and
easy incorporation of information into other Web Portals.
(http://www.infovista.com/products/pr...sp#vistaportal)

Description:

PortalSE allows a remote attacker to read any file on the filesystem as it
runs with root privileges by default. It is also susceptible to a directory
revelation issue.

Technical Details:

During a recent research engagement IRM found multiple vulnerabilites in the
Infovista PortalSE software. Using specially crafted URLs it is possible to
read any file on the filesystem. This is due to the product running with
super-user privileges so it is possible to gain the system's password
hashes.

Additionally, when selecting a non-existent server in the server field then
the response reveals a full directory path, which can be useful to an
attacker in fingerprinting the underlying operating system and directory
structure: -

An error occured while accessing the report '<nonexistentserver>_31457':
No Such Report Generated For You

[-] Hide details

/opt/InfoVista/PortalSE/files/default/<nonexistentserver>/31457/report.html
(No such file or directory)
java.io.FileNotFoundException:
/opt/InfoVista/PortalSE/files/default/<nonexistentserver>/31457/report.html
(No such file or directory)

Vendor & Patch Information:

The vendor has released a hotfix for the directory traversal issue
(IV00038969) which should be applied. The vendor does not deem the
information leakage of the directory path an issue and has not released a
hotfix for this.

Tested Versions:

PortalSE 2.0 Build 20087 on Solaris 8

Credits:

Research & Advisory: P Robinson

Disclaimer:

All information in this advisory is provided on an 'as is' basis in the hope
that it will be useful. Information Risk Management Plc is not responsible
for any risks or occurrences caused by the application of this information.


--A13407E9CD.1140629954/FreeBSD.csie.nctu.edu.tw--