Web Based Configuration possible security flaw

My coworkers and I found something quite interesting today...despite having configured FTP security settings (which have been confirmed to be set up and funcitoning. I can't open an FTP session to our remote target without specifying an admin user name and password) if you open the NI web based configuration tool in a browser, you can FTP to and from the target using the remote file browser without being logged in at all! Has anyone else experienced this??
CLA, LabVIEW Versions 2010-2013
Solved!
Go to Solution.

Apparently, these permissions are separate from FTP, but you can set these particular permissions on the Security configuration page of the web based configuration utility.
CLA, LabVIEW Versions 2010-2013

Similar Messages

Cannot connect to modem's web-based-configuration program

Hello,
I'm trying to connect to my modem's (D-Link DSL-321B) web-based-configuration program by giving its ip-address (192.168.1.1) in a Safari widow. I get the error message "Safari can't open page 192.168.1.1 because the server where the page is located isn't responding".
The modem is connected via ethernet cable to an airport time capsule. The mac is then connect via WiLan. I have tried other web browser programs, rebooted everything, reset the modem, connected the modem to my macbook via ethernet cable and read ALOT of information but I still can't find the solution and get into the menu. BTW, all Mac software is up to date.
I would be really grateful for some help. Thanks in advance.

Hi Linc, thanks for the reply and sorry for the delayed response. I have tried your recommendation and unfortunately, it did not help, same error message. Any other suggestions? Thanks

Linksys WRT54GX-v.2 Router Web-Based Configurator

The manual for this router says that a Mac can access the configurator for this router, yet when I do I get nothing but a couple graphics. No text. Why won't any browser on my computer render the page? Anyone else have this problem?

Hi,
Welcome to the Apple Discussions.
Some of these embedded web servers like the config pages in routers and the status pages in cable modems can be kind of funky. I have a wired Netgear router and have found that it works better with Camino or Firefox than Safari.
charlie

Extend Studio InContext CMS (Possible Security Flaw)

I suggest that one careful before uploading folders generated by the InContext CMS extension.
I found, in source code generated by the software, exposure of my domain name, my shared server root login and user password. It can be viewed in "view source" from any assigned CMS users browser.
Scary.

I'm guessing they might have figured out their mistake a few months ago and were a bit too embarrassed to come back and post a retraction, but it makes complete sense that you'd want to respond to it.
For future users who stumble across this one, here's a scenario (I'm guessing the most likely reason) where one might notice what the original poster was seeing...
If the OP accidentally added the PHP code to a file with the .html extension, they would be able to view the source and see the things they mention because servers don't process PHP in .html pages by default.

Registering the Web based application as a Partner Application

Good day
I went through the suggested documentation of registering a
web based application as a partner application of the SSO Login Server.
I installed the SSOSDK.JAR and went through the demo application (JSP Demo)
which consists of the following programs :
papp.jsp
ssoinclude.jsp
ssoEnablerJspBean
SSOEnablerBean
SSOSignon
As per the technical documentation,I register this demo application as a
partner application.
1 - The source code of the papp.jsp checks for the existence of the user
through method of ssoEnablerJspBean [getSSOUserInfo(request, response)] which
calls method of SSOEnablerBean [getSSOUserInfo (request, response) and this
method calls getUserInfo(p_request) of SSOEnablerBean (the same program) to
check the existence of the application cookie.
2 - If it doesn't exit , it redirect it to the SSO Login page for user
authentication.Once the user is authenticated, a SSO login cookie is created on
the client's browser and redirects back to the SSOSignOn.
3 - The SSOSignOn program creates the application cookie and redirects back to
the entry point of the demo application which is papp.jsp.
My Questions are as follows :
1 - Instead of creating a session object within my web based application to hold some
information used between the different pages, can I define them in the
application cookie? kindly advise? Is there any limitation for the length of
the application cookie? If yes, what will be the risk?
2 - The SSOSignOn program is calling a method in the SSOEnablerBean
[setPartnerAppCookie(response, request). Within this method , it is retrieving
the parameters values of the request object as :
request.getParameterValues("urlc")[0];
What is the role of this [urlc]? Is it hard coded? Can I change it?
3 - In order to ensure that I am still dealing with the same user, shall I put
the above security check procedure on each page of my weeb based application? Kindly advise?
Thanks in advance for your prompt feedback
regards

Dear Paul
I think there is a misunderstanding regarding the last correspondence.
I am talking about the customized home page of the PORTAL and not the home page of my web based application (JSP) .So in this case, Am I able to use the customized home page which contains a login portlet instead of the default Login page of the SSO Login Server.Kindly advise!!!
On the other hand, I am facing a problem during the surfing of the web based application.
The web based application consists mainly of two packages :
Package I : Bank.counter which contains a set of jsp pages.
JSP_HOME_COUNTER (MAIN PAGE WHICH CONTAINS 2 FRAMES)
JSP_LEFT_FRAME_COUNTER
JSP_MAIN_FRAME_COUNTER
JSP_MAIN_FRAME_COUNTER_DETAIL
Package II : Bank.portfolio which contains a set of jsp pages.
JSP_HOME_PORTFOLIO (MAIN PAGE WHICH CONTAINS 2 FRAMES)
JSP_LEFT_FRAME_PORTFOLIO
JSP_MAIN_FRAME_PORTFOLIO
Please note that the SSO classes are residing under the first package.
As agreed on in the third question, I am including in each page of my web based application, a security check procedure as follows :
<%@ include file="ssoinclude.jsp" %>
<%
if(usrInfo == null)
response.getWriter().println("<center>User information not found</center>");
else
my jsp code.......
%>
Please note that all the jsp page of the portfolio package are pointing to the SSO classes as follows :
<%@ include file="../counter/ssoinclude.jsp" %>
<%
if(usrInfo == null)
response.getWriter().println("<center>User information not found</center>");
else
my jsp code.......
%>
Once I invoke the JSP_HOME_COUNTER , it will render the JSP_LEFT_FRAME_COUNTER page and
JSP_MAIN_FRAME_COUNTER page which invokes the SSO Login page. Once the user has been authenticate, the result of the JSP_MAIN_FRAME_COUNTER is rendered successfully. The result contains an hyperlink to the
JSP_MAIN_FRAME_COUNTER_DETAIL page. As the user has been authenticated , this page is rendering automatically the result without displaying the SSO Login page. (Perfect as of now!!).
Once I invoke the JSP_HOME_PORTFOLIO from the JSP_HOME_COUNTER, it runs the security procedure without any rendering of the SSO Login page (fine!!) but redirects me back to JSP_HOME_COUNTER instead of rendering the result of the JSP_HOME_PORTFOLIO.
please note that the m_requestUrl variable in the SSOEnablerJSPBean class has been assigned the folowing value : JSP_HOME_COUNTER
Kindly advise .

WPA Security, Crashing OS, Locked out of Web-Based Setup Page. AAAaaarrrrrrgggg!

I tried several times to enable WPA security on my WMP54GS router by using the "Secure Easy Setup" button in the Wireless Network Monitor Panel. I pressed the lighted Cisco logo on the router as directed, I clicked on the "next" button on screen, and Windows crashed. (That is, my system rebooted and Windows reported that it had recovered from a serious error.) I am running XP. I also tried to enable security using the router’s web-based setup page. I followed the instructions, and a new web screen appeared stating "error on page." I tried again to enable security using the web-based setup page, but now it won't let me in using the default password (admin). I tried resetting the router by pressing the reset button for 30 seconds, but I still cannot access the web-based setup page. Sooooooo, I'm out of ideas. Can anyone help?
Thanks.

Hi
When configuring your wireless settings, use a wired computer and not a wireless computer. Because it will not be able to apply the new settings. Its like trying to troubleshoot a automobile malfunction while you are driving the car itself.
Just helping out...
"Success usually comes to those who are too busy looking for it"

WRT310N No Way To Setup and Configure Router. CD Setup No, Web Based Setup No

Purchased New WTR310N yesterday. LESA does not run from CD. Web based Setup Page Will Not Load. Did two 2 hr Remote Setup sessions so far with Linksys Techs in Phillipines and India. After 1st Tech was done, nothing would connect to router. Tech tried to setup our 4 PCs by setting up one as a server and using ICS to setup the rest. Tech disabled TTP, DHCP, ete everything that works as a home network. I think Tech also setup a password and user name on Router without telling me. I had to spend 2 hrs using Vista and XP Wizards to setup a router network, both wired and wireless. Since Router is not configured yet can only access unsecured wireless networks. But 2 wireless printers do not work yet. Tech today was excellent in India. She reinstalled my Linksys USB Wireless Adapter that I use to print with. Still not printing, and green light not coming on, on USB Adapter. Tech managed to upgrade Router Firmware, but could never get web based router setup to load. Got the password and user name box to show up once, but admin and blank username does not work. My XBox 360 installed in 15 seconds and is fast so Router working fine. So need help with getting Linksys USB Wireless Adapters to access wireless printers and somehow get router admin pages to load so I can turn on WEP and type in our WEP Code. Last router was Linksys 54G, all worked fine for years, then quit working so got new router. Any ideas before I try calling Tech Support again, thanks.

As you want to make the network secured but the admin password is not working....You have to reset the router and re-configutre it again...
Press and hold the reset button for 60 seconds...Release the reset button...Unplug the power cable from your router, wait for 30 seconds and re-connect the power cable...Now re-configure your router...
If your Internet Service Providor is Cable follow this link
If your Internet Service Providor is DSL follow this link

Is it possible to disable all web based features when no wifi is available?

I'm interested in buying a Firefox phone but I only what to use web based services when a wifi connection is given because my cell phone contract does not cover internet usage properly. Is this possible?

No, not really. I can't take you up on your advice and use delegates. The use case excludes PC all together - there is no computer nearby to be used. In my case they need to make and receive phone calls, be able to transfer calls, and have
a voice mail feature. Lync Edition device does not accommodate this use case well. Here are the issues so far.
1. You can't transfer calls unless phone is unlocked. There is a way to change that trough policy, but the phone lock policy works on per site basis. On a small deployment like ours with a single site this means phone lock for everyone or no
one.
2. Phone shows error about "Exchange integration" as we discussed above. Due to interface design choices this means that "menu" button is obscured form view. That makes it impossible for uninformed user to transfer a call.
Here is the bottom line the way I see it: the Lync Edition Phone is great for an office (cubical farm) environment, but when time comes to deal with special use cases the assumptions Lync/Exchange team made backfire. I'd have to go to Lync Server compatible
phone like Polycom VVX to get around phone lock issue. In Polycom world that is configurable on per phone basis, as, one would argue, it should be. Polycom have bugs of their own though - you can't make "blind transfer" a default method of transfer.
So, no good solution so far.

Pearl 8120 failing to load University's web based security page

I have a 8120 Blackberry pearl and it is connecting to the wireless and receiving an IP address however it won't redirect to the web based security screen that is used to log on. I tried the IT guys on campus but they were clueless.
Can Anyone Help?

You don't happen to go to Texas A&M do you? I tried to do this same thing on our campus (connect to VPN) and it doesn't work. The help desk central guys said they have recieved several emails recently regarding connecting new Blackberries (apparently 8120's or 8830's) to the network, and they couldn't get it to work. They believed it was a disagreement between the software and the network. I feel the same thing because I can see the network, I enter my password and username and try to connect, but it doesn't want to work for some reason. It says connection failed for some reason. If you find anything out just reply back to this. If I find anything out, I will also reply back, or maybe start a new thread. Jay
UPDATE: Okay, looked up a few things....this may alleviate the problem. Instead of connecting via the WiFi screen as usual, you may have to connect via the VPN screen. To get to this, go to Settings>Options>Security Options>VPN>Log In.
I haven't tried this yet, but I will soon to see if it works. There has got to be a way to get this thing to connect, I just don't know how to yet. More tomorrow...
Message Edited by jay47 on 09-15-2008 11:44 AM

Can I use SPRO to configure SAP CRM web based application.

Hi,
I am just 5 days old in SAP solutions.
I want to know if I can use SPRO (IMG) to configure master data and business processes pertaining to SAP CRM web based solution ?
Regards,
Diptendu.

Hi Diptendu,
You can indeed do some customizing in the SPRO regarding for example the PCUI (People Centric User Interface) of CRM.
Within SPRO take CRM and afterwards in the Basic Functions you have some customizing to be done. You can also look at the cookbook for the PCUI, which you can find on the service.sap.com/crm-inst site.
For the Interaction Webclient, there is a specific part for customizing in the SPRO under CRM --> Interaction Webclient.
Hope this helps,
Kind regards,
Micha

Acrobat 9.2.0 Update Breaks Text Box Tool, Possibly Introduces a New Security Flaw.

Anyone have any ideas for this one?
Once we upgraded to version 9.2.0 (This is a major security release that fixes a Javascript security flaw) our text box tool no longer works the way we want it and crashes the program.
Try this:
1. Open any PDF document on a Windows XP SP3 computer with Adobe Acrobat 9.2.0.
2. Add the 'Text Box Tool' to the toolbar by right-clicking the toolbar and selecting 'MoreTools' then placing a checkbox next to the 'Text Box Tool'.
3. Click the 'Text Box Tool' on the toolbar and draw a new textbox anywhere on the PDF document.
4. Click out of the textbox to cancel typing mode, then single click back on the textbox that you just created.
5. Right-click the textbox that you created and select 'Properties..."
6. Under the 'Appearance' tab,
a. Select Style: No Border
b. Select Fill Color: No Color
c. Check the box 'Make Properties Default'
d. Click OK.
7. Click the Text Box Tool again, and draw another textbox (Since there is no border you will not see it but you will still be drawing a textbox).
8. Let go of the mouse when you are done drawing your textbox rectangle and the program will crash at this point.
Results:
1. "An internal error occurred." dialog box is displayed.
2. After clicking ok the following "Microsoft Visual C++ Runtime Library" dialog box is displayed:
"Runtime Error!
Program: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe
R6025
- pure virtual function call
3. After clicking ok another dialog box is displayed:
Error signature
AppName: acrobat.exe AppVer: 9.2.0.124 ModName: acrobat.dll Offset: 000509dd
4. The same error has occurred on all five computers that we tested the new version on.
Expected results: A new textbox is created and you may start typing in text (This was the behavior in version 9.1.3).
Additional Information
At times, we need to add information to PDF files (i.e missing dates, etc). We have always used the Text Box Tool to do this with no border, and with no fill color as this is the EASIEST and FASTEST way to add information to PDF files in a precise manner. We want the fill color to be transparent so that we can fit text in between and exactly on lines easier, and so that there is not a solid background box behind the text. We want no border because a border around text that needs to go on a line looks stupid. Up until version 9.2 this procedure worked fine. Now, the program will crash. Perhaps this even adds another security vulnerability if the crash could be exploited. We want to maintain security by patching Adobe to address the JavaScript vulnerability that was addressed in version 9.2.0, however, we are not able to update our users as the new version breaks the fundamental purpose that we use Adobe Acrobat for. We are stuck with the vulnerable version 9.1.3 until this problem is addressed. Disabling JavaScript is not an option either, as we use a Java plug-in on a daily basis.
Any thoughts would be great, I have attached screenshots of the errors.

The question still is not answered.
The problem continues in Acrobat 8.1.7 for Windows, even after updating toAcrobat 8.2.0. ( I can't comment on whether recent updates to Acrobat 9 fix the problem in Acrobat 9.)
The internal error after text insertion problem occurs even with PDF documents created in Acrobat 8, i.e., not only old versions of PDF files. We have the text box insertion icon in the toolbar, and the properties set to "no color" for the box and "0" width for the text box lines, as other commentators have noted.
The problem did not exist when Acrobat 8 Pro was installed, it was introduced by one of the updaters.
The main reason we use Acrobat, rather than much cheaper PDF-creation software, is to annotate PDF files (including inputting data into spaces in standard forms).
So justify the high price of Acrobat and fix the problem please, Adobe !

Is it possible to create a rendition targeted for the web based content viewer?

The way PDFs render in the web broswer is (presently) pretty bad.
Can we create a rendition of a Folio which is specifically (and only) for the purpose of being viewed in the web based content viewer?
Also can we leverage the downloading options in the Folio Producer to yield better results and less lags in rendering? I would like to suggest that Adobe adds some kind of indicator/status-bar which shows remiaing assets still being downloaded. For example, video overlays aren't immediately available.
Despite these quirks, this new capability is huge and we really appreciate it!
-Mark
Mark Kunoff
Informational Systems Specialist
IU Communications
Indiana University Public Affairs and Government Relations
[email protected]

It's too bad the selectable text will go away. This will also hamper the web-based views in terms of accessability, correct? - something very important to our stake holders.
Does Adobe plan to bring these good points of the PDF format back in a future release?
Thanks for your consistently fast replies Bob!
-Mark

Security Flaw on iPhone???

Critical iPhone security flaw found
Fortify Software, a security firm, has uncovered a critical security flaw in the Apple iPhone which could lead to phishing attacks.
Because the iPhone only displays the first few characters of a URL in its Safari web browser, phishers could easily hide a fraudulent URL at the end of a link without the user even knowing it.
Even worse, the iPhone connects the browser and the phone in such a way that it may be possible to embed scam telephone numbers into a site to make the phone automatically dial the scam number.
Let’s hope Apple is working on a fix for this one because that is some scary stuff. Now, if you input addresses yourself and use bookmarks, the chances of being affected by this are relatively minimal. That said, watch out for strange emails and Google results — you can’t always trust that either.
Anybody read this? Any comments or thoughts??? Valid?

It's hardly a new flaw since disguising URLs in links has been common practice for some time. However, while the browser does indeed only show a limited number of characters from the URL being opened (more if in landscape mode than portrait) to get to the URL at all the user would either have to enter it manually, or encounter it in an email or web page where the full URL should readily be discovered.
It seems probable to me that over time, security holes will be found as in all accessible and discoverable devices on the internet. Based on experience with Apple and MacOS, I would have confidence that genuine weaknesses found in the iPhone will benefit from security fixes as expeditiously as possible.

Web based non-intrusive backup providers

Any recommendations for an on-line (Web based) non-intrusive backup solution for Mac?
Thanks!

If possible, I would use the firewall for VPN and not the router, as you may run to limitations. Also, for the 2800 series to run VPN, you need a new IOS installed.
Q. How does the licensing work for Cisco IOS SSL VPN?
A. There are two types of licencing schemes for Cisco IOS SSL VPN.
For the Cisco 870, 1800, 2800, 3800, and 7200 series routers, licenses are cost-effective paper licenses just like CCME or SRST licenses. There's no software key to enable the feature hence there is no support issue with using Cisco IOS SSL VPN once you have the Advanced Security or higher Cisco IOS image loaded on the Router. You can purchase the Feature license as a spare in packs of 10, 25 and 100 simultaneous users directly from Cisco.com configuration tool. If you already have a router, use the spare SKUs as follows: FL-WEBVPN-10-K9= FL-WEBVPN-25-K9= FL-WEBVPN-100-K9= depending upon the number of supported users for your platform.
For the Cisco 890, 1900, 2900, and 3900 NGX series ISRs, licensing will be enforced through the Cisco Product Licensing Registration Portal. The next generation of ISRs will also use a new set of SKUs as follows: FL-SSLVPN10-K9(=), FL-SSLVPN25-K9(=), and FL-SSLVPN100-K9(=). For more details on licensing, please visit http://www.cisco.com/en/US/products/ps9677/products_ios_technology_home.html.
Licenses are not interchangeable between the ISRs and NGX Series ISRs.
http://www.cisco.com/c/en/us/products/collateral/security/ios-sslvpn/prod_qas0900aecd80323cba.html
HTH

H.264 Web based Encoder Demo

Hi,
before some weeks ago i red a newsletter that adobe has include a h.264 encoder in FP 11.
Well, here we go i thought and start to develope a web based h.264 encoder for our CDN. Here is a first version that i want to share with you developers.
Onlinelib Web Encoder Version 0.2:
http://onlinelib.de/labs.html
Please do not use this in serious projects. You will need also a RTMP Server for testing and of course a web-player. I will include a player option inside the encoder for internal testing.
There are a lot of features missing, but the basic h.264 encoding is working on my Mac Pro and our CDN.
What i found out during the development:
Please correct me if i post something wrong.
Contra:
- AAC Encoding for Audio is missing. Without AAC we cant product ipad / iphone compatbile streams. Flash iOS cross-compiler supports CPU native speex decoding, same for nellymoser, but you cant mix them cause native h.264 decoding in iOS is also not working and you cant send the iOS native quicktime player a bytearray for decoding h.264.We can have access to the raw micro data, but its useless cause you cant transmux the packets to the camera stream. I think a native AAC encoder in AS3 or alchemy is possible but without more access to the encoder its useless.
- No Stereo Encoding. That is really a big minus point. I study all docs and cant find if its possible to encode 2 channels.
- No access to compressed frames for video or audio. Without getting access to the compressed frames we cant use HTTP streaming, packing for the new HTTP protocol that is accessable sinse FP 10.1. In times of hacks and security its important that we developer can protect our streams with own encryption technologies. Not possible right now. RTMP(e) is a option, but this encryption is really useless (my 2 cent mind). A DES is stronger than the hole RTMP(e).We also are not able to calculate our own bandwidth alogs.
- I thought that adobe will include VP8 Encoder / Decoder in FP11. I hope they will do this.
Pro:
- I think the encoder is based on MainConcept SDK, works for me. Baseline and Main is fast enought toDo realtime. I cant find a way to set motionVectors, bframes that can be used in mainprofile. I saw that in some level(s) profile h2.64 the encoder makes some strange colorspace effects (false colors).
-We can change cameras, micro, bitrate, fps during a streaming-sessions. That´s cool and not possbile with Flash Media Desktop (FME) Encoder. You have to disconnect the FME first, then set the changes re-connect again.
- p2p is also working and you can mix server and p2p. We port the rtmfp protocol to an embedded device:
http://walyou.com/img/world-smallest-pc-space-cube-4.jpg
The p2p option in the public encoder is not useable cause adobe has patent-rights on the rtmfp protocol. If i have time i will inlcude a cirrus service.
Best,
Gary
http://onlinelib.de

Thanks for the input. What do you mean by encoding it as H.264 not mp4 - which setting affects that?
Maybe I already has it?
here is what I have now:
Video compression setting
Compression type: H.264
Frame rate: current fps
Key frames: every 24 frames
Frame Reordering: Yes
Compressor quality: High
Encoding: Best Quality (Multi-pass)
Data rate: Restrict to 800 kbits/sec
Optimized for: Download
Sound
Format: AAC
Channels: mono
Rate: 44.1 kHz
Show advanced setting: yes
Render setting:
- quality: normal
MPEG 4 AAC LC Encoder Settings:
- Encoding stratey: Average bit rate
- Target bit rate: 96 kbps
Inspector panel
File format: Quicktime Movie
Extension: mp4
Allow job segmenting: yes
Video setting: Enabled
Audio setting: enabled
Streaming: none

Web Based Configuration possible security flaw

Similar Messages

Maybe you are looking for