ID

VAR-200907-0376

CVE

CVE-2009-2344

TITLE

Sourcefire DC and 3D Sensor of Web Vulnerabilities that gain privileges in the base management interface

DESCRIPTION

The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components. Sourcefire 3D Sensor and Defense Center are prone to multiple security-bypass vulnerabilities. An attacker may exploit these issues to gain administrative access to the vulnerable device, which may aid in further attacks. Versions prior to the following are vulnerable: Sourcefire 3D Sensor 4.8.2 Sourcefire Defense Center 4.8.2. Although the user.cgi PERL script correctly verifies that the incoming request belongs to an authenticated session, in this case it is blindly granted read and write access without regard to the role of the originator of the request, so even users with the lowest access levels (such as Users who have not configured any roles) can also promote them to administrators and change other roles or account parameters at will. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Sourcefire 3D Sensor and Defense Center "user.cgi" Security Bypass SECUNIA ADVISORY ID: SA35658 VERIFY ADVISORY: http://secunia.com/advisories/35658/ DESCRIPTION: Gregory Duchemin has reported a vulnerability in Sourcefire 3D Sensor and Sourcefire Defense Center, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to improper access restrictions while processing requests sent to the admin/user/user.cgi script. This can be exploited to e.g. gain administrative access to the appliance by sending a specially crafted POST request to the affected script. NOTE: Other scripts are reportedly affected by similar errors. SOLUTION: Update to firmware version 4.8.2. PROVIDED AND/OR DISCOVERED BY: Gregory Duchemin ORIGINAL ADVISORY: http://milw0rm.com/exploits/9074 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

permissions and access control

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Gregory Duchemin c3rb3r@hotmail.com

SOURCES

LAST UPDATE DATE

2025-04-10T23:05:07.840000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE