mailing list archives
Nokia Electronic Documentation - Multiple Vulnerabilities
From: "@stake Advisories" <advisories () atstake com>
Date: Mon, 15 Sep 2003 16:38:59 -0400
-----BEGIN PGP SIGNED MESSAGE-----
Advisory Name: Nokia Electronic Documentation - Multiple Vulnerabilities
Release Date: 09/15/2003
Application: NED (Nokia Electronic Documentation)
Platform: Windows NT4 and WebLogic tested (others may be
Severity: Information disclosure / cross-site scripting Open
Authors: Ollie Whitehouse <ollie () atstake com>
Vendor Status: Informed / Statement Below
CVE Candidate: (pending) Multiple Nokia Electronic Documentation
Nokia (http://www.nokia.com) provides a web-based documentation
interface called NED for a number of it's cellular network products.
@stake have discovered three vulnerabilities in this product:
- Cross-site scripting
- Directory listing of certain directories under the web-root
- Being able to use NED as a proxy server for HTTP requests
Normally, NED deployments are within the OAM/O&M networks of the
cellular operator. However, as @stake discussed in the white paper
'GPRS Wireless Security: Not Ready for Prime Time'
reports/acrobat/atstake_gprs_security.pdf) these networks can be
exposed to risks which are not normally within the operators risk
The following examples are from a standard NED installation, which
in @stake's experience is upon NT4/IIS 3.0.
1) Cross-site scripting
A very simple cross-site scripting vulnerability exists. For
example, if an attacker makes the following request:
This will cause the malicious code to run in the attacker's browser
2) Directory Listings
It is possible to cause the underlying application server
(WebLogic) to return a directory listing of the web-root. This is
achieved by simply supplying a '.' as the location to the NED
application. For example:
In addition, this will also return the physical path that NED
is installed on, which is by default:
3) Open Proxy
By specifying a location which contains the HTTP protocol URI, as
contained within the example URL below, one can cause NED to
retrieve the page in question and deliver the contents back. This
can potentially be used to launch attacks against hosts that the
NED server may have access to but the attacker does not (for
example in a DMZ deployment).
"Nokia has analyzed the three vulnerabilities in NED 5.0 that
@stake has discovered, and find them only to have consequences
under exceptional circumstances.
Exceptional circumstances meant here are potential intruders
(outsiders or own personnel) who have accessed the telecom
operators production/O&M network without authorization.
Telecom operators production networks and especially O&M networks
are isolated from other internal networks and public internet and
also operators own O&M personnel are considered to be trustworthy.
Thus Nokia will not provide any hot fixes (patches or workaround)
at this moment but will inform telecom operator customers about
the potential vulnerabilities and will remedy a defect in the next
NED 5.1 release upgrades at the beginning of the next year."
Look for the Nokia upgrades at the beginning of 2004. In addition,
operators should look to deploy additional network-based access
control around devices that have NED deployed on them.
Common Vulnerabilities and Exposures (CVE) Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.
(pending) Multiple Nokia Electronic Documentation Issues
@stake Vulnerability Reporting Policy:
@stake Advisory Archive:
Copyright 2003 @stake, Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
-----END PGP SIGNATURE-----
- Nokia Electronic Documentation - Multiple Vulnerabilities @stake Advisories (Sep 16)