The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Symantec FireWall/VPN Appliance model 200 leak of security


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Mon, 16 Feb 2004 08:49:49 +0100
From: Davide Del Vecchio <dante@alighieri.org.>
To: [email protected]
Subject: Symantec FireWall/VPN Appliance model 200 leak of security


Symantec FireWall/VPN Appliance model 200 leak of security
Davide Del Vecchio Adv#9 Discovered in: 15/01/2004 Date: 15/02/2004 Tested on FireWall/VPN Applicance model 200 Vendor notified. Description of the Appliance: The FireWall/VPN Appliance 200 is an integrated security and networking device that provides easy secure, and cost-effective Internet connectivity between locations. With its all-in-one functionality, small businesses and remote offices can create a high-speed local network that enables secure access and interaction via the Internet with remote locations, business partners, and corporate networks. The problem: Editing the password administration page, the password is in clear text. To access the administration page, you have to insert the admin psw, but your password will be cached in your pc and in every proxy server. It makes the Appliance NOT usefull to be managed remotely. Solution: Contacted the Symantec Enterprise Support, they told me the "feature" is "by design", because of the HTTP connection instead of HTTPS, so it was NOT a bug (even if they did not know about it). My only statement was "adding vulns to vulns.. what about a java script?" Credits: Davide Del Vecchio would like to thank all the people supporting him and his research, Diego Fuggetta, Gianluca Bellantuono, Filippo Sismondo, Carlo Martini, Giorgio Vitelli, Davide Zanella, his special sad friend Marcello Barnaba, finally but in primis his love that never leaves him alone. Happy Birthday to me. Disclaimer: The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. ^^^^^^^^ Please send suggestions, updates, and comments to: Davide Del Vecchio , Dante Alighieri - dante at alighieri dot org http://www.alighieri.org -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Davide Del Vecchio "Dante Alighieri" dante (at) alighieri (dot) org http://www.alighieri.org http://www.bluejack.it http://www.ezln.it - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру