TITLE:
Cyclades AlterPath Manager Security Bypass Vulnerabilities

SECUNIA ADVISORY ID:
SA14378

VERIFY ADVISORY:
http://secunia.com/advisories/14378/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Exposure of system information

WHERE:
>From local network

OPERATING SYSTEM:
Cyclades AlterPath Manager 1.x
http://secunia.com/product/4704/

DESCRIPTION:
sullo has reported some vulnerabilities in AlterPath Manager, which
can be exploited by malicious users to bypass certain security
restrictions, and by malicious people to disclose some system
information.

1) An error in the restriction of consoles in "consoleConnect.jsp"
can be exploited to connect to arbitrary consoles by specifying the
console name in the "consolename" parameter.

2) A user can specify the "adminUser" parameter in "saveUser.do" and
thereby gain administrative privileges when the user account is saved
by setting the "adminUser" parameter to "true".

3) The "/about.html" page can be accessed without authorisation,
which can be exploited to disclose some system information (e.g.
version numbers).

The vulnerabilities have been reported in version 1.2.1 and prior.
Other versions may also be affected.

SOLUTION:
The vulnerabilities will reportedly be fixed in the upcoming 1.2.5
version.

Disable the HTTP interface and use SSH instead. This may affect
functionality.

PROVIDED AND/OR DISCOVERED BY:
sullo, CIRT.net

ORIGINAL ADVISORY:
http://www.cirt.net/advisories/alterpath_console.shtml
http://www.cirt.net/advisories/alterpath_privesc.shtml
http://www.cirt.net/advisories/alterpath_disclosure.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------