----------------------------------------------------------------------

Want to work within IT-Security?

Secunia is expanding its team of highly skilled security experts.
We will help with relocation and obtaining a work permit.

Currently the following type of positions are available:
http://secunia.com/quality_assurance_analyst/
http://secunia.com/web_application_security_specialist/ 
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
vCAP Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA21862

VERIFY ADVISORY:
http://secunia.com/advisories/21862/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, Exposure of system information, Exposure of
sensitive information, DoS

WHERE:
>From remote

SOFTWARE:
vCAP 1.x
http://secunia.com/product/11929/

DESCRIPTION:
Some vulnerabilities have been discovered in vCAP, which can be
exploited by malicious people to disclose sensitive information,
conduct cross-site scripting attacks, or cause a DoS (Denial of
Service).

1) An input validation error within the handling of HTTP requests can
be exploited to access arbitrary files outside the web root via
directory traversal attacks.

2) An error in the processing of parameter values using a malformed
URL encoded representation can be exploited to crash vCAP.EXE by
sending a specially crafted HTTP request.

Example:
http://[host]/%AA%A

The web service needs to be restarted manually before functionality
is restored.

3) Input passed in an URL for a non-existent resource is not properly
sanitised before being returned to users in an error message. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in context of a vulnerable site.

Example:
http://[host]:6100/[code]

4) Input passed to the "statusmsg" parameter in RegisterPage.cgi is
not properly sanitised before being returned to users. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of a vulnerable site.

Example:
http://[host]:6100/RegisterPage.cgi?statusmsg=[code]&session=1

The vulnerabilities have been confirmed in version 1.7.0. Other
versions may also be affected.

SOLUTION:
Restrict access to trusted users only and filter malicious characters
and character sequences in a proxy.

PROVIDED AND/OR DISCOVERED BY:
1-2) secuma massime, MorX Security Research Team
3-4) AliG

ORIGINAL ADVISORY:
http://www.morx.org/vcap.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------