OSVDB ID: 3256

Title: NETObserve User Authentication Bypass

Info

Disclosure

Dec 30, 2003

Discovery

Dec 30, 2003

Dates

Exploit

Dec 30, 2003

Solution

Unknown

Description

The NETObserve PC surveillance software uses a web service to provide remote access to the monitored PC. This web service requires a username and password to access, however this authentication can be bypassed by specifying the cookie value of 'login=0'. Once access has been obtained, all features of the NetObserve system are available, including the ability to upload files and execute commands.

Classification

Unknown or Incomplete

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): Configure the NETObserve service to only allow trusted IP addresses to connect.

Products

ExploreAnywhere Software

NETObserve

2.0
2.8
2.9

References

Credit

Unknown or Incomplete



Direct URL: http://osvdb.org/3256