VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

Description

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) – CVE-2012-4941

SQL Injection Vulnerabilities: Multiple query string parameters for both authenticated and unauthenticated users are not properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CVE-2012-4942
Persistent XSS Vulnerabilities: The application’s web interface allows users to provide text input into many fields which are stored in a database and displayed back to the user in various places. Input passed to all text fields in the application is not properly sanitized before being displayed to users. This can be exploited to execute arbitrary HTML and script code in a user’s browser session.

CWE-352: Cross-Site Request Forgery (CSRF) – CVE-2012-4943
CSRF Vulnerabilities: The application’s web interface allows users to perform many actions via HTTP POST requests without performing any validity checks to verify the requests. This can be exploited to change the administrator’s/user’s passwords, creating new user accounts, deleting user accounts, granting additional site permissions, and more by tricking a logged in administrator or other user into visiting a malicious web site.

CWE-280: Improper Handling of Insufficient Permissions or Privileges – CVE-2012-4944
Unrestricted File Upload Vulnerabilities: The application has several pages that are available to unauthenticated users where arbitrary files are able to be uploaded onto the system. This can be exploited to upload arbitrary files to the system and could be used to compromise the system.

CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’) – CVE-2012-4945
Unauthenticated Site Actions: The application has several pages that could be exploited to allow an unauthenticated user to perform actions in the application that only an authenticated user should be able to perform.

CWE-326: Inadequate Encryption Strength – CVE-2012-4946
Reversible Encrypted Password Vulnerability: The user passwords for the application are stored in a reversible XOR encrypted format. If a malicious user is able to obtain the encrypted passwords, they would be able to be decrypted. A password key and the encryption/decryption function is located in afile.

CWE-312: Cleartext Storage of Sensitive Information – CVE-2012-4947
Information Disclosure Vulnerabilities: The application has several pages that can be exploited by malicious users to disclose potentially sensitive information. Database connection information including clear text credentials are stored in a file.

Impact

A remote unauthenticated attacker may obtain sensitive information, cause a denial of service condition or execute arbitrary code with the privileges of the application.

Solution

Update

The vendor has stated that these vulnerabilities have been addressed in version 4.08, version 4.08.01 and version 4.09.00. The vendor recommends that users update to version 4.09.00 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAgile FleetCommanderAffected14 Mar 201230 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
7.0
E:POC/RL:OF/RC:UC

Environmental
1.8
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/89.html
http://cwe.mitre.org/data/definitions/79.html
http://cwe.mitre.org/data/definitions/352.html
http://cwe.mitre.org/data/definitions/280.html
http://cwe.mitre.org/data/definitions/77.html
http://cwe.mitre.org/data/definitions/326.html
http://cwe.mitre.org/data/definitions/312.html
http://www.agilefleet.com/

Credit

Thanks to Travis Lee for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4941
CVE-2012-4942
CVE-2012-4943
CVE-2012-4944
CVE-2012-4945
CVE-2012-4946
CVE-2012-4947

Date Public:
07 Nov 2012

Date First Published:
07 Nov 2012

Date Last Updated:
07 Nov 2012

Document Revision:
25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#841851: Mutiny Technology virtual appliance command injection vulnerability

Vulnerability Note VU#841851
Mutiny Technology virtual appliance command injection vulnerability

Original Release date: 22 Oct 2012 | Last revised: 22 Oct 2012

Overview

The Mutiny Technology virtual appliance contains a command injection vulnerability which could allow an attacker to inject commands into the appliance.

Description

CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

The Mutiny Technology virtual appliance contains a network interface menu which is vulnerable to command injection with root privileges.

Impact

An authenticated attacker can run arbitrary commands on the appliance.

Solution

Update

The vendor has stated that this vulnerability has been addressed in Mutiny Technology virtual appliance version 4.5-1.12. Users are advised to upgrade to Mutiny Technology virtual appliance version 4.5-1.12 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Restricting access would prevent an attacker from accessing a Mutiny Technology virtual appliance using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedMutiny TechnologiesAffected09 Aug 201209 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
2.1
AV:N/AC:H/Au:S/C:N/I:P/A:N

Temporal
1.4
E:U/RL:OF/RC:UC

Environmental
0.6
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/77.html
http://www.mutiny.com/releasehistory.php

Credit

Thanks to Christopher Campbell for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-3001

Date Public:
07 Oct 2012

Date First Published:
22 Oct 2012

Date Last Updated:
22 Oct 2012

Document Revision:
8

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#441363: HP Virtual SAN appliance root shell command injection

Vulnerability Note VU#441363
HP Virtual SAN appliance root shell command injection

Original Release date: 17 Aug 2012 | Last revised: 17 Aug 2012

Overview

The HP Virtual SAN appliance version 9.5 is susceptible to a root shell command injection (CWE-77) vulnerability.