TippingPoint Zero Day Initiative
 

IBM System Networking Switch Center ZipDownload.jsp Information Disclosure Vulnerability

ZDI-15-554: November 10th, 2015

CVE ID

CVSS Score

Affected Vendors

Affected Products

    System Networking Switch Center

Vulnerability Details


This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability.

The specific flaws exist within the IBM SNSC Web Service, which listens by default on ports 40080 (HTTP) or 40443 (HTTPS) for requests to the administration panel. The first is a race condition, which allows the for the temporary use of a fixed privileged account which is forbidden from interactive login, and the second is the ability to specify any file on the system in ZipDownload.jsp. By combining these two vulnerabilities, an attacker can read arbitrary files on the system.

Vendor Response

IBM has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2015-06-25 - Vulnerability reported to vendor
    2015-11-10 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Andrea Micalizzi (rgod)