Linux ntop Unauthorized File Retrieval Vulnerability

ntop is a network usage monitoring tool for Unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via HTTP with the -w parameter (Web mode). Starting ntop in Web mode allows remote access to the functions it provides.

ntop Versions 1.2a7 to 1.2a9 do not properly authenticate requests. These versions are vulnerable to a '../../' request whereby unauthorized files can be retrieved, including files that are only readable by root.

By exploiting this vulnerability, unauthorized users can successfully request files from the server that should only be readable by user's with root privileges. This includes files in the /etc/passwd directory, the /etc/shadow directory, and all the configuration files in the /etc directory.

If unauthorized users obtain password files, and weak passwords were chosen, then they could guess the passwords and further compromise the host.

Upgrade this service to a later version, which is available for download from http://www.ntop.org/.