SalesLogix GetConnection account disclosure

saleslogix-getconnection-account-disclosure (17754) The risk level is classified as MediumMedium Risk

Description:

SalesLogix could allow a remote attacker to obtain sensitive information. By establishing a connection to TCP port 1707 and issuing a specially-crafted GetConnection command, a remote attacker could cause the server to disclose the database username and password.


Consequences:

Obtain Information

Remedy:

Reportedly, customers can obtain a fix for this vulnerability from the SalesLogix Web site. See References.

References:

  • BugTraq Mailing List, Mon Oct 18 2004 - 09:05:30 CDT : Multiple vulnerabilities in Sage Saleslogix.
  • SalesLogix Web site: SalesLogix Support Login.
  • BID-11450: Best Software SalesLogix Multiple Remote Vulnerabilities
  • CVE-2004-1611: SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port 1707.
  • OSVDB ID: 10947: SalesLogix Client/Server Authentication Weakness
  • OSVDB ID: 10948: SalesLogix Server Database Authentication Credential Disclosure
  • SA12883: Saleslogix Multiple Vulnerabilities
  • SECTRACK ID: 1011769: SalesLogix Grants Administrative Access to Remote Users and Permits SQL Injection and Arbitrary File Uploads

Platforms Affected:

  • SalesLogix SalesLogix

Reported:

Oct 18, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page