At Ease 5.0 Access Control Vulnerability

vendor:

At Ease

by:

SecurityFocus

7.5

CVSS

HIGH

At Ease 5.0 Access Control Vulnerability

N/A

CWE

Product Name: At Ease

Affected Version From: 5

Affected Version To: 5.0.2

Patch Exists: YES

Related CWE: N/A

CPE: o:apple:at_ease

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: MacOS 7.6.1, AppleShare IP 5.0.3, Netscape 4.0.7

1998

At Ease 5.0 Access Control Vulnerability

At Ease 5.0 is vulnerable to an access control vulnerability that allows a user to access any user's volume on the server through a web browser. By logging in as any user that has access to Netscape Communicator and typing in the file path, it is possible to browse through any user's files and download them.

Mitigation:

Upgrade to a version of At Ease 5.0 that is not vulnerable.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/531/info

At Ease 5.0 will allow a user to access any user's volume on the server through a web browser.

The tested configuration is as follows:

MacOS 7.6.1 (should work with anything greater than 7)
At Ease 5.0.2
AppleShare IP 5.0.3
Netscape 4.0.7 (No reason it shouldn't work from .99 to 4.5)

Log in as any user that has access to Netscape Communicator, and type in
f i l e://Macintosh%20HD/System%20Folder/
and you are able to access the disk.

Do the same thing, except use
f i l e://At%20Ease%20Volume%20Name/At%20Ease%20%Docs/username
and it's quite easy to browse through anyones files.

It is possible to download files from that users directory. I have been unable to actually open any of the files once they are downloaded, however in an educational setting, just viewing names in a certian directory could constitute some serious problems (such as if a teacher works with Special Education studends, and has a list of documents to their parents).