Airmagnet management interfaces multiple vulnerabilities

[noreply () ptsecurity ru]

Airmagnet management interfaces multiple vulnerabilities

 

A management interface of AirMagnet Enterprise contains several middle-risk vulnerabilities. Vulnerabilities ranges 
from reflected and stored Cross-Site scripting to remote code execution and protection bypass.

 

Smart Sensor Edge Sensor

 

Reflected (non persistent) XSS in 404 error page. 

Stored (persistent) XSS in log viewer via user name in failed logon record. 

 

Enterprise Server Web-interface stored XSS

 

AirMagnet Enterprise Server provides feature which can be used to check server status via https (Enterprise Server 
Status Overview). One of the pages (ACL) displays monitored APs status. SSID of AP echoed to the user browser without 
screening which can lead to XSS conditions.

 

AirMagnet Enterprise console and Remote Sensor console (Laptop) XAS

 

AirMagnet AirWISE feature provide detailed description of detected attacks. . AirMagnet console uses for displaying 
information about an intrusion embedded Internet Explorer object and inserts in the HTML template SSID of access points 
(or the client) without screening.

 

AirMagnet Enterprise console SSL mitm attack

 

AirMagnet Enterprise console don't validate Enterprise Server certificate, which can be used by attacker who can 
realize mitm condition between Server and Console to decrypt traffic and sniff administrator and sensors passwords. 

 

DISCLOSURE TIMELINE

 

May - September 2006 - Attempts to contact vendor without intelligible response.

18 October 2006 - Public disclosure

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/