JVNDB-2009-000016

Access Analyzer CGI Professional Version vulnerability allows third party to gain administrative privileges

Access Analyzer CGI Professional Version from futomi's CGI Cafe contains a vulnerability that allows an attacker to gain administrative privileges.

Access Analyzer CGI provided by futomi's CGI Cafe is a software to analyze web access logs. Access Analyzer CGI Professional Version contains a vulnerability that allows an attacker to gain administrative privileges.

Taketo Ikeuchi and Seiki Sugahara reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.

Base Metrics: 7.5 (High) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: Partial

futomi Co.,Ltd.

• Access Analyzer CGI Professional Version Ver 4.11.5 and earlier

A remote attacker could impersonate an administrator of Access Analyzer CGI Professional Version

[Update the Software]
Update to the latest version according to the information provided by the vendor.

[Workarounds]
As a workaround to this vulnerability, change the settings in the server where the software is installed and disable access to the administrator menu until the software is updated.

futomi Co.,Ltd.

• futomi's CGI Cafe : Update for the users of Access Analyzer CGI Professional Version (Japanese)

1. JVN : JVN#63511247
2. National Vulnerability Database (NVD) : CVE-2009-1206
3. Common Vulnerabilities and Exposures (CVE) : CVE-2009-1206
4. Secunia Advisory : SA34516
5. ISS X-Force Database : 49525
6. Common Weakness Enumeration (CWE) : Credentials Management (CWE-255) [IPA Evaluation]
7. JVN iPedia (English) : JVNDB-2009-000016

[2009/03/31]
  Web page published