VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

Description

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) – CVE-2012-4941

SQL Injection Vulnerabilities: Multiple query string parameters for both authenticated and unauthenticated users are not properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CVE-2012-4942
Persistent XSS Vulnerabilities: The application’s web interface allows users to provide text input into many fields which are stored in a database and displayed back to the user in various places. Input passed to all text fields in the application is not properly sanitized before being displayed to users. This can be exploited to execute arbitrary HTML and script code in a user’s browser session.

CWE-352: Cross-Site Request Forgery (CSRF) – CVE-2012-4943
CSRF Vulnerabilities: The application’s web interface allows users to perform many actions via HTTP POST requests without performing any validity checks to verify the requests. This can be exploited to change the administrator’s/user’s passwords, creating new user accounts, deleting user accounts, granting additional site permissions, and more by tricking a logged in administrator or other user into visiting a malicious web site.

CWE-280: Improper Handling of Insufficient Permissions or Privileges – CVE-2012-4944
Unrestricted File Upload Vulnerabilities: The application has several pages that are available to unauthenticated users where arbitrary files are able to be uploaded onto the system. This can be exploited to upload arbitrary files to the system and could be used to compromise the system.

CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’) – CVE-2012-4945
Unauthenticated Site Actions: The application has several pages that could be exploited to allow an unauthenticated user to perform actions in the application that only an authenticated user should be able to perform.

CWE-326: Inadequate Encryption Strength – CVE-2012-4946
Reversible Encrypted Password Vulnerability: The user passwords for the application are stored in a reversible XOR encrypted format. If a malicious user is able to obtain the encrypted passwords, they would be able to be decrypted. A password key and the encryption/decryption function is located in afile.

CWE-312: Cleartext Storage of Sensitive Information – CVE-2012-4947
Information Disclosure Vulnerabilities: The application has several pages that can be exploited by malicious users to disclose potentially sensitive information. Database connection information including clear text credentials are stored in a file.

Impact

A remote unauthenticated attacker may obtain sensitive information, cause a denial of service condition or execute arbitrary code with the privileges of the application.

Solution

Update

The vendor has stated that these vulnerabilities have been addressed in version 4.08, version 4.08.01 and version 4.09.00. The vendor recommends that users update to version 4.09.00 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAgile FleetCommanderAffected14 Mar 201230 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
7.0
E:POC/RL:OF/RC:UC

Environmental
1.8
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/89.html
http://cwe.mitre.org/data/definitions/79.html
http://cwe.mitre.org/data/definitions/352.html
http://cwe.mitre.org/data/definitions/280.html
http://cwe.mitre.org/data/definitions/77.html
http://cwe.mitre.org/data/definitions/326.html
http://cwe.mitre.org/data/definitions/312.html
http://www.agilefleet.com/

Credit

Thanks to Travis Lee for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4941
CVE-2012-4942
CVE-2012-4943
CVE-2012-4944
CVE-2012-4945
CVE-2012-4946
CVE-2012-4947

Date Public:
07 Nov 2012

Date First Published:
07 Nov 2012

Date Last Updated:
07 Nov 2012

Document Revision:
25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#555668: JAMF Software Casper Suite contains a cross-site request forgery vulnerability

Vulnerability Note VU#555668
JAMF Software Casper Suite contains a cross-site request forgery vulnerability

Original Release date: 24 Sep 2012 | Last revised: 25 Sep 2012

Overview

JAMF Software’s Casper Suite is susceptible to a cross-site request forgery (CSRF) (CWE-352) vulne…

VU#471364: Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities

Vulnerability Note VU#471364
Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities

Original Release date: 13 Sep 2012 | Last revised: 14 Sep 2012

Overview

Trend Micro InterScan Messaging Security Suite Version 7.1-Build_Win32_1394 has been reported to be susceptible to cross-site scripting and cross…

VU#174119: Solarwinds Network Performance Monitor 10.2.2 contains multiple vulnerabilities

Vulnerability Note VU#174119
Solarwinds Network Performance Monitor 10.2.2 contains multiple vulnerabilities

Original Release date: 03 Aug 2012 | Last revised: 03 Aug 2012

Overview

Solarwinds Network Performance Monitor 10.2.2 and possibly earlier versions contain a cross-site scripting (XSS), and cross-site request forgery (CSRF) vulner…

VU#709939: Bradford Network Sentry v5.3 NS500 appliance contains multiple vulnerabilities

Vulnerability Note VU#709939
Bradford Network Sentry v5.3 NS500 appliance contains multiple vulnerabilities

Original Release date: 13 Jun 2012 | Last revised: 13 Jun 2012

Overview

Bradford Network Sentry v5.3 NS500 appliance contains multiple vulnerabilities which could allow an attacker to execute arbitrary code with the privileges of t…

VU#221180: BMC Identity Management Suite cross-site request forgery vulnerability

Vulnerability Note VU#221180
BMC Identity Management Suite cross-site request forgery vulnerability

Original Release date: 11 Jun 2012 | Last revised: 11 Jun 2012

Overview

BMC Identity Management Suite v7.5.00.103 and possibility other versions are vulnerable to cross-site request forgery vulnerabilities.

VU#773035: AutoFORM PDM Archive contains multiple vulnerabilities

Vulnerability Note VU#773035
AutoFORM PDM Archive contains multiple vulnerabilities

Original Release date: 29 May 2012 | Last revised: 30 May 2012

Overview

AutoFORM PDM Archive contains multiple vulnerabilities which could allow an attacker to execute arbitrary code with the privileges of the application.

VU#722963: Bloxx Web Filtering multiple vulnerabilities

Vulnerability Note VU#722963
Bloxx Web Filtering multiple vulnerabilities

Original Release date: 29 May 2012 | Last revised: 30 May 2012

Overview

Bloxx Web Filtering contains multiple XSS, CSRF, and authentication bypass vulnerabilities.

Description