IBM System Networking Switch Center ZipDownload.jsp Information Disclosure Vulnerability
2 Feb. 2016
Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 18.104.22.168 and Lenovo Switch Center before 22.214.171.124 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443.
The information has been provided by rgod.
* IBM System Networking Switch Center (SNSC) before 126.96.36.199 and Lenovo Switch Center before 188.8.131.52
* IBM System Networking Switch Center (SNSC) after 184.108.40.206 and Lenovo Switch Center after 220.127.116.11
This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability.The specific flaw exists within the IBM SNSC DB Service, that listens by default on port 40999. This service allows an unauthenticated user to obtain the account details for the SNSC Administrator, including the password. The password is stored using reversible encryption, and both the key and salt are static. An attacker can use this information to obtain the plaintext password for the SNSC Administrator or any other known account.