Who's On?

	Membership:
	Latest: Brady
	Past 24 Hours: 0
	Prev. 24 Hours: 0
	Overall: 5274

	People Online:
	Visitors: 430
	Members: 0
	Total: 430

Name	Points
Greg Moeller	4184
David Williams	3349
JonA	3291
Kat V	2984
Woozy	1973
Jimmy Chiu	1883
Kwane McNeal	1437
Ragu Raghavan	1375
Roger French	1315
mark.cook	1244

security hole in LBI

2 Replies

0 Subscribed to this topic

22 Subscribed to this forum

Sort:

Author

Messages

Jimmy Chiu

Veteran Member Send Private Message

Posts: 641

9/29/2010 5:49 PM

I just logged this hole with Lawson. Hopefully they will fix it soon.

Anyway, here is the security hole.

Ie: http://server:port/efs/ConfigurationAssistant

No login check, nothing, and you can make changes.

Matthew Nye

Veteran Member Send Private Message

Posts: 514

9/29/2010 6:15 PM

Lawson recommends that after the installation this file is renamed and moved out of the EFS directory. Its meant as an installation and troubleshooting device but shouldnt be left in place. Additionally you could secure this specific file using Authentication security through your web server. Security hole, security by obscurity or just another "undocumented functionality" perhaps.

Matthew Nye

Veteran Member Send Private Message

Posts: 514

10/21/2010 8:41 PM

Lawson recommends that after the installation this file is renamed and moved out
of the EFS directory. Its meant as an installation and troubleshooting device
but shouldnt be left in place. Additionally you could secure this specific file
using Authentication security through your web server. Security hole, security
by obscurity or just another "undocumented functionality" perhaps.