VU#950172: Dell OpenManage Server Administrator version 7.1.0.1 DOM-based XSS vulnerability

January 9, 2013 By

Vulnerability Note VU#950172
Dell OpenManage Server Administrator version 7.1.0.1 DOM-based XSS vulnerability

Original Release date: 09 Jan 2013 | Last revised: 09 Jan 2013

Overview

Dell OpenManage Server Administrator version 7.1.0.1 and earlier contains a DOM-based cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Dell OpenManage Server Administrator version 7.1.01 and earlier contains a DOM-based cross-site scripting vulnerability.

Impact

A remote attacker may be able to execute arbitrary script in the context of the end-user’s browser session.

Solution

We are currently unaware of a practical solution to this problem.

Restrict Access

The Dell OpenManage Server Administrator interface should not be Internet facing.

Vendor Information (Learn More)

The vulnerability reporter has confirmed that Dell OpenManage Server Administrator 6.5.0.1, 7.0.0.1 and 7.1.0.1 are affected by this vulnerability.

VendorStatusDate NotifiedDate UpdatedDell Computer Corporation, Inc.Affected20 Nov 201204 Jan 2013If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal
3.6
E:U/RL:W/RC:UC

Environmental
1.4
CDP:LM/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Tenable Network Security for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-6272

Date Public:
09 Jan 2013

Date First Published:
09 Jan 2013

Date Last Updated:
09 Jan 2013

Document Revision:
5

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Filed Under: Security Tagged With: , , ,

VU#571068: ManageEngine AssetExplorer fails to properly sanitize XML asset data submission

December 6, 2012 By

Vulnerability Note VU#571068
ManageEngine AssetExplorer fails to properly sanitize XML asset data submission

Original Release date: 06 Dec 2012 | Last revised: 06 Dec 2012

Overview

ManageEngine AssetExplorer version 5.6.0 build number 5610 and possibly older versions is vulnerable to multiple stored XSS vulnerabilities via XML asset data submission.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

ManageEngine AssetExplorer version 5.6.0 build number 5610 and possibly older versions is vulnerable to multiple stored XSS vulnerabilities via XML asset data submission. Asset data is submitted by a program on client systems in an XML format via a POST request to http://[hostname]:8989/discoveryServlet/WsDiscoveryServlet?COMPUTERNAME=[computer name]. This submission is not authenticated. It has been reported that several of the data fields in that XML document are not properly filtered on ingestion by the XML processor or on output in the HTML interface. An example of a vulnerable element is the DocRoot/Computer_Information/output element. The value supplied to this element is echoed verbatim when viewing the asset in AssetExplorer, potentially resulting in a persistent XSS attack.

Impact

An attacker with access to the ManageEngine AssetExplorer web interface can conduct a cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

Update

The vendor has stated that this vulnerability has been addressed in ManageEngine AssetExplorer build 5614 and the issue id AE-46841. Users are advised to update to ManageEngine AssetExplorer build 5614 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing the ManageEngine AssetExplorer web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedZohoAffected02 Aug 201230 Nov 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
7.8
AV:N/AC:M/Au:N/C:P/I:C/A:N

Temporal
5.5
E:POC/RL:OF/RC:UC

Environmental
1.5
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://www.manageengine.com/products/asset-explorer/
http://www.manageengine.com/products/asset-explorer/sp-readme.html
http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Philip Martin for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-5956

Date Public:
30 Nov 2012

Date First Published:
06 Dec 2012

Date Last Updated:
06 Dec 2012

Document Revision:
12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Filed Under: Security Tagged With: , , , ,

VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

November 7, 2012 By

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

Filed Under: Security Tagged With: , , , , , , , , , , ,

VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

November 7, 2012 By

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

Description

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) – CVE-2012-4941

SQL Injection Vulnerabilities: Multiple query string parameters for both authenticated and unauthenticated users are not properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CVE-2012-4942
Persistent XSS Vulnerabilities: The application’s web interface allows users to provide text input into many fields which are stored in a database and displayed back to the user in various places. Input passed to all text fields in the application is not properly sanitized before being displayed to users. This can be exploited to execute arbitrary HTML and script code in a user’s browser session.

CWE-352: Cross-Site Request Forgery (CSRF) – CVE-2012-4943
CSRF Vulnerabilities: The application’s web interface allows users to perform many actions via HTTP POST requests without performing any validity checks to verify the requests. This can be exploited to change the administrator’s/user’s passwords, creating new user accounts, deleting user accounts, granting additional site permissions, and more by tricking a logged in administrator or other user into visiting a malicious web site.

CWE-280: Improper Handling of Insufficient Permissions or Privileges – CVE-2012-4944
Unrestricted File Upload Vulnerabilities: The application has several pages that are available to unauthenticated users where arbitrary files are able to be uploaded onto the system. This can be exploited to upload arbitrary files to the system and could be used to compromise the system.

CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’) – CVE-2012-4945
Unauthenticated Site Actions: The application has several pages that could be exploited to allow an unauthenticated user to perform actions in the application that only an authenticated user should be able to perform.

CWE-326: Inadequate Encryption Strength – CVE-2012-4946
Reversible Encrypted Password Vulnerability: The user passwords for the application are stored in a reversible XOR encrypted format. If a malicious user is able to obtain the encrypted passwords, they would be able to be decrypted. A password key and the encryption/decryption function is located in afile.

CWE-312: Cleartext Storage of Sensitive Information – CVE-2012-4947
Information Disclosure Vulnerabilities: The application has several pages that can be exploited by malicious users to disclose potentially sensitive information. Database connection information including clear text credentials are stored in a file.

Impact

A remote unauthenticated attacker may obtain sensitive information, cause a denial of service condition or execute arbitrary code with the privileges of the application.

Solution

Update

The vendor has stated that these vulnerabilities have been addressed in version 4.08, version 4.08.01 and version 4.09.00. The vendor recommends that users update to version 4.09.00 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAgile FleetCommanderAffected14 Mar 201230 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
7.0
E:POC/RL:OF/RC:UC

Environmental
1.8
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/89.html
http://cwe.mitre.org/data/definitions/79.html
http://cwe.mitre.org/data/definitions/352.html
http://cwe.mitre.org/data/definitions/280.html
http://cwe.mitre.org/data/definitions/77.html
http://cwe.mitre.org/data/definitions/326.html
http://cwe.mitre.org/data/definitions/312.html
http://www.agilefleet.com/

Credit

Thanks to Travis Lee for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4941
CVE-2012-4942
CVE-2012-4943
CVE-2012-4944
CVE-2012-4945
CVE-2012-4946
CVE-2012-4947

Date Public:
07 Nov 2012

Date First Published:
07 Nov 2012

Date Last Updated:
07 Nov 2012

Document Revision:
25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Filed Under: Security Tagged With: , , , , , , , , , , ,

VU#802596: Pattern Insight 2.3 contains multiple vulnerabilities

November 2, 2012 By

Vulnerability Note VU#802596
Pattern Insight 2.3 contains multiple vulnerabilities

Original Release date: 02 Nov 2012 | Last revised: 08 Nov 2012

Overview

The Pattern Insight web interface contains multiple vulnerabilities.

Description

CWE-352: Cross-Site Request Forgery (CSRF) CVE-2012-4935: Pattern Insight: CSRF protections do not exist

When an already authorized victim navigates to a malicious site containing a hidden form request, it is possible for the malicious site to make authenticated requests to Pattern Insight on behalf of the victim.

CWE-16: Configuration: CVE-2012-4936: Pattern Insight: clickjacking/framing vulnerability
It is possible to frame the application and thus is vulnerable to clickjacking. This can be mitigated by adding “X-Frame-Options” => “DENY” to the response headers. Furthermore, frame busting code can be added to the application for further protection and in the case that the victim’s browser does not support X-Frame-Options. See https://www.owasp.org/index.php/Clickjacking

CWE-384: Session Fixation CVE-2012-4937: Pattern Insight: Insecure session management leading to privilege escalation
Pattern Insight session management is insecure, making privilege escalation and authentication bypass possible. When a user logs into Pattern Insight, the user’s browser either has or does not have a jsession_id session cookie associated with the Pattern Insight domain. If the user does not have a session cookie associated with the Pattern Insight domain, the server provides the user a jsession_id and associates that session id with the user’s current session. If the user already has a session cookie associated with the Pattern Insight domain, the server checks the “validity” of the session cookie. If the cookie is of “valid” form, the server associates the provided jsession_id session cookie with user’s new session.

Attack scenario:
1. Attacker obtains a “valid” session key.
2. Attacker sets victim’s jsession_id session cookie with the “valid” session key in step 1
3. The attacker now knows the session id of a valid session

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CVE-2012-4938: Pattern Insight: HTML Injection In Banner Message
An admin can edit the banner message seen by all users. HTML is allowed in this message. A possible solution is anti-samy for whitelisting where HTML is still needed (https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project).

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CVE-2012-4950 Pattern Insight: HTML Injection In Keyword Search page
The error messages on the Keyword Search page do not properly escape characters after encountering a character that the backend cannot parse. This results in a reflective XSS if an attacker sends a victim a properly crafted URL and the victim visits the application using that link.

Impact

An attacker with access to the Pattern Insight web interface can conduct a cross-site scripting, cross-site request forgery, or privilege escalation attack, which could be used to result in information leakage, privilege escalation, and/or denial of service. Also, with the ability to frame the application, an attacker can perform clickjacking attacks.

Solution

We are currently unaware of a practical solution to this problem.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing the Pattern Insight web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedPattern InsightAffected07 Sep 201224 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
6.0
AV:N/AC:M/Au:S/C:P/I:P/A:P

Temporal
4.6
E:POC/RL:W/RC:UC

Environmental
1.6
CDP:LM/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/352.html
http://cwe.mitre.org/data/definitions/79.html
http://cwe.mitre.org/data/definitions/16.html
http://cwe.mitre.org/data/definitions/384.html
https://www.owasp.org/index.php/Clickjacking
https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project
https://owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet
https://www.owasp.org/index.php/Clickjacking#Defending_against_Clickjacking
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

Credit

Thanks to the reporter who wishes to remain anonymous.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4935
CVE-2012-4936
CVE-2012-4937
CVE-2012-4938
CVE-2012-4950

Date Public:
02 Nov 2012

Date First Published:
02 Nov 2012

Date Last Updated:
08 Nov 2012

Document Revision:
15

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Filed Under: Security Tagged With: , , , , ,

VU#203844: SolarWinds Orion IPAM web interface reflected xss vulnerability

October 31, 2012 By

Vulnerability Note VU#203844
SolarWinds Orion IPAM web interface reflected xss vulnerability

Original Release date: 31 Oct 2012 | Last revised: 31 Oct 2012

Overview

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. It has been reported that input fields are not sanitized allowing for authenticated users to execute scripts against the SolarWinds Orion IPAM web interface

Attack scenario:
1. http://[server name]/Orion/IPAM/IPAMSummaryView.aspx
2. Enter the following in the “Search for an IP address” field: “>
3. Click Search, which will redirect you to the following URL:http://[server name]/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E

Impact

An attacker with access to the SolarWinds Orion IPAM web interface can conduct a reflected cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

Apply Hotfix

The vendor has stated this vulnerability has been addressed in IPAM-v3.0-HotFix1. Users are advised to apply the hotfix. The vendor has stated this hotfix will be incorporated in the next version of IPAM v3.1, due this quarter and that customers under maintenance can get access to this hot fix via their SolarWinds Customer Portal.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing the SolarWinds Orion IPAM web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedSOLARWINDSAffected02 Aug 201231 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
3.5
AV:N/AC:M/Au:S/C:P/I:N/A:N

Temporal
2.7
E:POC/RL:W/RC:UC

Environmental
0.9
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Anthony Trummer for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4939

Date Public:
31 Oct 2012

Date First Published:
31 Oct 2012

Date Last Updated:
31 Oct 2012

Document Revision:
10

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Filed Under: Security Tagged With: , , , ,

VU#603276: OTRS contains a cross-site scripting vulnerability

October 17, 2012 By

Vulnerability Note VU#603276
OTRS contains a cross-site scripting vulnerability

Original Release date: 17 Oct 2012 | Last revised: 17 Oct 2012

Overview

Open Technology Real Services (OTRS) contains a cross-site scripting (XSS) (CWE-79) vulnerability in the body of HTML emails viewed within the OTRS application.

Description

OTRS is an open source Help Desk and ITIL® V3 compliant IT Service Management platform.

OTRS Security Advisory 2012-03 states:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10.

Impact

A remote attacker may be able to perform a cross-site scripting attack against a logged in OTRS user by sending a specifically crafted HTML email.

Solution

Apply an Update

OTRS 2.4.15, 3.0.17 and 3.1.11 were released to address this vulnerability.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedOTRSAffected07 Sep 201217 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal
3.9
E:POC/RL:OF/RC:C

Environmental
2.9
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/
http://www.otrs.com/en/open-source/community-news/releases-notes/
http://znuny.com/en/#!/advisory/ZSA-2012-03
http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Mike Eduard of Znuny GmbH for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:
CVE-2012-4751

Date Public:
22 Oct 2012

Date First Published:
17 Oct 2012

Date Last Updated:
17 Oct 2012

Document Revision:
18

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Filed Under: Security Tagged With: , ,

VU#471364: Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities

September 13, 2012 By

Vulnerability Note VU#471364
Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities

Original Release date: 13 Sep 2012 | Last revised: 14 Sep 2012

Overview

Trend Micro InterScan Messaging Security Suite Version 7.1-Build_Win32_1394 has been reported to be susceptible to cross-site scripting and cross…

Filed Under: Security Tagged With: , , , , ,

VU#143395: F5 Networks ASM appliance contains a cross-site scripting vulnerability

September 10, 2012 By

Vulnerability Note VU#143395
F5 Networks ASM appliance contains a cross-site scripting vulnerability

Original Release date: 10 Sep 2012 | Last revised: 10 Sep 2012

Overview

F5 Networks ASM appliance versions 10.0.0 through 11.2.0 HF2 are susceptible to a cross-site scripting vulnerability in the traffic overview page.

Filed Under: Security Tagged With: , , ,

VU#777007: Ipswitch WhatsUp Gold 15.02 contains SQL injection and XSS vulnerabilities

September 4, 2012 By

Vulnerability Note VU#777007
Ipswitch WhatsUp Gold 15.02 contains SQL injection and XSS vulnerabilities

Original Release date: 04 Sep 2012 | Last revised: 04 Sep 2012

Overview

Ipswitch WhatsUp Gold 15.02 has been reported to contain blind SQL injection and cross-site scripting vulnerabilities.

Des…

Filed Under: Security Tagged With: , , , , ,