Full Disclosure mailing list archives
Multiple vulnerabilities in Highwall Enterprise and Highwall Endpoint management interface
From: noreply () ptsecurity ru
Date: Wed, 18 Oct 2006 17:47:45 +0400
Multiple vulnerabilities in Highwall Enterprise and Highwall Endpoint 4.0.2.11045 management interface SUMMARY Highwall Enterprise and Highwall Endpoint wireless IDS management interface contain multiple vulnerabilities which can lead to privilege escalation and code execution. DETAILS Web interface of Highwall Enterprise and Highwall Endpoint don't properly screens characters in user supplied input. This can lead to Multiple Cross-Site Scripting and SQL Injection conditions. Vulnerabilities can be exploited by malicious system operator to escalate privileges or run code on his choice in context of Microsoft SQL Server back-end database. Also these vulnerabilities possible can be exploited by external attacker by using Access Point with special created SSID to bypass security restrictions or escalate privileges. DISCLOSURE TIMELINE 8 September 2006 - Initial vendor contact, no response received. September 2006 - Initial vendor contact, no response received. 18 October 2006 - Public disclosure _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Multiple vulnerabilities in Highwall Enterprise and Highwall Endpoint management interface noreply (Oct 18)