Home page logo

bugtraq logo Bugtraq mailing list archives

From: ian.vitek () IXSECURITY COM
Date: Tue, 7 Nov 2000 14:09:35 +0100

iXsecurity Security Vulnerability Report
No: iXsecurity.20001107.compaq-wbm.a

Vulnerability Summary

Problem:  The default installation of Compaq Web-Based
               Management on a Netware server reveals
               sensitive system files

Threat:   Anyone that has access to port 2301 on a
               Netware server can read the system
               password (Remote Console password)

Platform: Compaq Web-Based Management on Netware
               (Software version 2.28 verified)

Solution: Disable the Web Agent

Vulnerability Description
http://netware.server.with.CWBM:2301/survey is
accessible for everyone by default and contains
sensitive system files:
The system password (Remote Console password)
and other passwords (SNMP ControlCommunity)
may be in clear text in any of these files.

Compaq recommend that you disable the web agent
until a resolution has been provided.

Additional Information
Many administrators install Compaq Web-Based Management
by default when they are installing Netware on a Compaq
machine. Web-Based Management listens on port 2301 and
anonymous access is allowed by default. iXsecurity have
to point out that none of our customers have changed
any Compaq user password until the first audit report
Some Compaq installations have ports 49400 and 49401 open
too. These ports are not verified.

Vendor response
Mr. Vitek,

This is a known issue with an advisory available on the Compaq website as
indicated below:


Until a resolution has been provided, it would be recommended that you
disable the web agents as indicated in that advisory.

Thank You,
Compaq eServices
TRACKING NUMBER: A00000367277-00001144068

//Ian Vitek
mailto:ian.vitek () ixsecurity com

iXsecurity (former Infosec) is a Swedish and United
Kingdom based tigerteam that have worked with computer-
related security since 1982 and done technical security
audits (pentests) since 1996. iXsecurity is now searching
for co-workers in Sweden and UK.
Call Stafferod for more information
tel: +46-8-6621070
mailto:christer.stafferod () ixsecurity com

  By Date           By Thread  

Current thread:
  • iXsecurity.20001107.compaq-wbm.a ian . vitek (Nov 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]