|
Airmagnet
management interfaces multiple vulnerabilities A
management interface of AirMagnet Enterprise contains several middle-risk
vulnerabilities. Vulnerabilities ranges from reflected and stored Cross-Site
scripting to remote code execution and protection bypass. Smart
Sensor Edge Sensor Reflected
(non persistent) XSS in 404 error page. Stored
(persistent) XSS in log viewer via user name in failed logon record.
Enterprise
Server Web-interface stored XSS AirMagnet
Enterprise Server provides feature which can be used to check server status via
https (Enterprise Server Status Overview). One of the pages (ACL) displays
monitored APs status. SSID of AP echoed to the user browser without screening
which can lead to XSS conditions. AirMagnet
Enterprise console and Remote Sensor console (Laptop) XAS AirMagnet
AirWISE feature provide detailed description of detected attacks. . AirMagnet
console uses for displaying information about an intrusion embedded
Internet Explorer object and inserts in the HTML template SSID of access points
(or the client) without screening. AirMagnet
Enterprise console SSL mitm attack AirMagnet
Enterprise console don’t validate Enterprise Server certificate, which can be
used by attacker who can realize mitm condition between Server and Console to
decrypt traffic and sniff administrator and sensors passwords.
DISCLOSURE
TIMELINE May -
September 2006 - Attempts to contact vendor without intelligible
response. 18 October
2006 – Public disclosure |
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
