mailing list archives
Four Vulnerabilities in SurfControl's SuperScout Email Filter Administrative Server
From: "'ken'@FTU" <ken () ftusecurity com>
Date: 08 Oct 2002 21:54:50 -0400
Please note these vulnerabilities are *not* the ones mentioned by Matt
Moore last week.
I've been working with SurfControl for a few months now to resolve these
issues in the Administrative Web interface for the SuperScout Email
Filter. (Read: I discovered these vulnerabilities independently, before
Matt Moore's post.)
SurfControl released a fix. Please contact them for it.
Now on with the disclosure.
The four SurfControl vulnerabilities are as follows:
1) a cross-site scripting vulnerability
2) user name and password exposure
3) Content-Length GET Denial of Service
4) Incomplete GET Request Denial of Service
The executable effected is STEMWADM.
1) Cross-Site Scripting Issue
As Matt Moore explained, the product does not filter user input. The
user does not need to be authenticated to have the following executed
against their browser.
2) Data Integrity Problem
Any user with access to the URL below will receive the user names and
passwords (in plain text) of every user in the SurfControl
URL: http://<IP Address>/web/usermgr/userlist.asp
Sample HTML output:
href='actions/edituser.asp?User=ken&Password=ken&Enabled=Enabled&Email=ken () ftusecurity com' title='Edit user'
onMouseOver="window.status='Edit ken';return true;" onMouseOut="window.status=' ';return
href='actions/edituser.asp?User=test&Password=test&Enabled=Enabled&Email=ken () ftusecurity com' title='Edit user'
onMouseOver="window.status='Edit test';return true;" onMouseOut="window.status=' ';return
3) Denial of Service via missing Content-Length Parameter
If one requests a web page and does not supply a content-length value
the server crashes and must be restarted.
4) Denial of Service via an incomplete GET request
If a GET request is made but does not finish (\r\n\r\n), the server will
continue to wait for the closing characters. As a result no one else may
request a web page, in effect denying service to other administrators.
...serving straight HTML since '02
- Four Vulnerabilities in SurfControl's SuperScout Email Filter Administrative Server 'ken'@FTU (Oct 09)