Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 5.3

This advisory discloses security vulnerabilities that we have found in the iSymphony Server component.

  • Customers who have downloaded and installed iSymphony should implement OS-based firewalling to their existing iSymphony installations to fix this vulnerability.  

i9 Technologies is committed to improving product security and an update will be posted which addresses this issue.

If you have questions or concerns regarding this advisory, please raise a support request at http://www.getisymphony.com/support.

 

Section
Column

Security Vulnerabilities

Vulnerability

Severity

HIGH

Risk Assessment

iSymphony, by default uses the following TCP ports to communicate with the outside world:

TCP Port NumberPurpose
50000Client <-> Server Event Communication
50001Command Line Interface
50002Text Based Presence Status Socket
50003Embedded HTTP Server To Serve Java WebStart (JNLP) Files

iSymphony Server TCP sockets on the above listed TCP port numbers do not have IP/Subnet based permission schema.  If your iSymphony Server installation's ports 50001 to 50003 are accessible via a network connection and not firewalled, the the above ports may be subject to malicious attackers, or internal organization information may be obtained from telnet based usage of this port (see note below).

Info
titleEncryption

Port 50000 does utilize encryption for server-client authentication and message passing, so it would be incredibly unlikely for malicious attackers to utilize this port in any meaningful fashion.

Vulnerability

iSymphony does not provide a mechanism implementing IP based permissions allowing for selective source-address connections to the iSymphony Command Line or Text Based Interfaces.

Fix

Utilize IPTables / IPChains (Linux), IPFW (BSD), 3rd Party Firewall implementation or appliance to effect firewalling based filtering prohibiting unauthorized access to TCP Ports listed above on machine hosting the iSymphony Server component.

Column
width300px

 


Panel
titleIn this advisory

Table of Contents
maxLevel4
minLevel2