VU#950172: Dell OpenManage Server Administrator version 7.1.0.1 DOM-based XSS vulnerability

Vulnerability Note VU#950172
Dell OpenManage Server Administrator version 7.1.0.1 DOM-based XSS vulnerability

Original Release date: 09 Jan 2013 | Last revised: 09 Jan 2013

Overview

Dell OpenManage Server Administrator version 7.1.0.1 and earlier contains a DOM-based cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Dell OpenManage Server Administrator version 7.1.01 and earlier contains a DOM-based cross-site scripting vulnerability.

Impact

A remote attacker may be able to execute arbitrary script in the context of the end-user’s browser session.

Solution

We are currently unaware of a practical solution to this problem.

Restrict Access

The Dell OpenManage Server Administrator interface should not be Internet facing.

Vendor Information (Learn More)

The vulnerability reporter has confirmed that Dell OpenManage Server Administrator 6.5.0.1, 7.0.0.1 and 7.1.0.1 are affected by this vulnerability.

VendorStatusDate NotifiedDate UpdatedDell Computer Corporation, Inc.Affected20 Nov 201204 Jan 2013If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal
3.6
E:U/RL:W/RC:UC

Environmental
1.4
CDP:LM/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Tenable Network Security for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-6272

Date Public:
09 Jan 2013

Date First Published:
09 Jan 2013

Date Last Updated:
09 Jan 2013

Document Revision:
5

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#571068: ManageEngine AssetExplorer fails to properly sanitize XML asset data submission

Vulnerability Note VU#571068
ManageEngine AssetExplorer fails to properly sanitize XML asset data submission

Original Release date: 06 Dec 2012 | Last revised: 06 Dec 2012

Overview

ManageEngine AssetExplorer version 5.6.0 build number 5610 and possibly older versions is vulnerable to multiple stored XSS vulnerabilities via XML asset data submission.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

ManageEngine AssetExplorer version 5.6.0 build number 5610 and possibly older versions is vulnerable to multiple stored XSS vulnerabilities via XML asset data submission. Asset data is submitted by a program on client systems in an XML format via a POST request to http://[hostname]:8989/discoveryServlet/WsDiscoveryServlet?COMPUTERNAME=[computer name]. This submission is not authenticated. It has been reported that several of the data fields in that XML document are not properly filtered on ingestion by the XML processor or on output in the HTML interface. An example of a vulnerable element is the DocRoot/Computer_Information/output element. The value supplied to this element is echoed verbatim when viewing the asset in AssetExplorer, potentially resulting in a persistent XSS attack.

Impact

An attacker with access to the ManageEngine AssetExplorer web interface can conduct a cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

Update

The vendor has stated that this vulnerability has been addressed in ManageEngine AssetExplorer build 5614 and the issue id AE-46841. Users are advised to update to ManageEngine AssetExplorer build 5614 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing the ManageEngine AssetExplorer web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedZohoAffected02 Aug 201230 Nov 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
7.8
AV:N/AC:M/Au:N/C:P/I:C/A:N

Temporal
5.5
E:POC/RL:OF/RC:UC

Environmental
1.5
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://www.manageengine.com/products/asset-explorer/
http://www.manageengine.com/products/asset-explorer/sp-readme.html
http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Philip Martin for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-5956

Date Public:
30 Nov 2012

Date First Published:
06 Dec 2012

Date Last Updated:
06 Dec 2012

Document Revision:
12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#558132: Dell OpenManage Server Administrator contains a cross-site scripting vulnerability

Vulnerability Note VU#558132
Dell OpenManage Server Administrator contains a cross-site scripting vulnerability

Original Release date: 14 Nov 2012 | Last revised: 14 Nov 2012

Overview

Dell OpenManage Server Administrator version 7.1 and earlier contains a cross-site scripting vulnerability.

Description

Dell OpenManage Server Administrator version 7.1 and earlier contains a cross-site scripting vulnerability (CWE-79).

Impact

A remote attacker may be able to execute arbitrary script in the context of the end-user’s browser session.

Solution

Apply an Update

Users should download the appropriate patch for the version of OpenManage they have installed.

OpenManage Server Administrator Managed Node Patch for OM7.1 (Version 7.1.0.1)
OpenManage Server Administrator Managed Node Patch for OM7.0 (Version 7.0.0.1)
OpenManage Server Administrator Managed Node Patch for OM6.5 (Version 6.5.0.1)

Restrict Access

The Dell OpenManage Server Administrator interface should not be Internet facing.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedDell Computer Corporation, Inc.Affected-14 Nov 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal
3.9
E:POC/RL:OF/RC:C

Environmental
2.9
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/79.html
http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=5JDN0&osCode=WNET&fileId=3082293694
http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=PCXMR&osCode=WNET&fileId=3082295344
http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=JJMWP&osCode=WNET&fileId=3082295338

Credit

Thanks to David Ferrest and Dell for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:
CVE-2012-4955

Date Public:
31 Oct 2012

Date First Published:
14 Nov 2012

Date Last Updated:
14 Nov 2012

Document Revision:
10

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

VU#427547: Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Vulnerability Note VU#427547
Agile FleetCommander and FleetCommander Kiosk versions prior to 4.08 contain multiple vulnerabilities

Original Release date: 07 Nov 2012 | Last revised: 07 Nov 2012

Overview

Agile FleetCommander and FleetCommander Kiosk were found to have multiple XSS, CSRF, information disclosure and SQLi vulnerabilities.

Description

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) – CVE-2012-4941

SQL Injection Vulnerabilities: Multiple query string parameters for both authenticated and unauthenticated users are not properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CVE-2012-4942
Persistent XSS Vulnerabilities: The application’s web interface allows users to provide text input into many fields which are stored in a database and displayed back to the user in various places. Input passed to all text fields in the application is not properly sanitized before being displayed to users. This can be exploited to execute arbitrary HTML and script code in a user’s browser session.

CWE-352: Cross-Site Request Forgery (CSRF) – CVE-2012-4943
CSRF Vulnerabilities: The application’s web interface allows users to perform many actions via HTTP POST requests without performing any validity checks to verify the requests. This can be exploited to change the administrator’s/user’s passwords, creating new user accounts, deleting user accounts, granting additional site permissions, and more by tricking a logged in administrator or other user into visiting a malicious web site.

CWE-280: Improper Handling of Insufficient Permissions or Privileges – CVE-2012-4944
Unrestricted File Upload Vulnerabilities: The application has several pages that are available to unauthenticated users where arbitrary files are able to be uploaded onto the system. This can be exploited to upload arbitrary files to the system and could be used to compromise the system.

CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’) – CVE-2012-4945
Unauthenticated Site Actions: The application has several pages that could be exploited to allow an unauthenticated user to perform actions in the application that only an authenticated user should be able to perform.

CWE-326: Inadequate Encryption Strength – CVE-2012-4946
Reversible Encrypted Password Vulnerability: The user passwords for the application are stored in a reversible XOR encrypted format. If a malicious user is able to obtain the encrypted passwords, they would be able to be decrypted. A password key and the encryption/decryption function is located in afile.

CWE-312: Cleartext Storage of Sensitive Information – CVE-2012-4947
Information Disclosure Vulnerabilities: The application has several pages that can be exploited by malicious users to disclose potentially sensitive information. Database connection information including clear text credentials are stored in a file.

Impact

A remote unauthenticated attacker may obtain sensitive information, cause a denial of service condition or execute arbitrary code with the privileges of the application.

Solution

Update

The vendor has stated that these vulnerabilities have been addressed in version 4.08, version 4.08.01 and version 4.09.00. The vendor recommends that users update to version 4.09.00 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAgile FleetCommanderAffected14 Mar 201230 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
7.0
E:POC/RL:OF/RC:UC

Environmental
1.8
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/89.html
http://cwe.mitre.org/data/definitions/79.html
http://cwe.mitre.org/data/definitions/352.html
http://cwe.mitre.org/data/definitions/280.html
http://cwe.mitre.org/data/definitions/77.html
http://cwe.mitre.org/data/definitions/326.html
http://cwe.mitre.org/data/definitions/312.html
http://www.agilefleet.com/

Credit

Thanks to Travis Lee for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4941
CVE-2012-4942
CVE-2012-4943
CVE-2012-4944
CVE-2012-4945
CVE-2012-4946
CVE-2012-4947

Date Public:
07 Nov 2012

Date First Published:
07 Nov 2012

Date Last Updated:
07 Nov 2012

Document Revision:
25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#203844: SolarWinds Orion IPAM web interface reflected xss vulnerability

Vulnerability Note VU#203844
SolarWinds Orion IPAM web interface reflected xss vulnerability

Original Release date: 31 Oct 2012 | Last revised: 31 Oct 2012

Overview

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. It has been reported that input fields are not sanitized allowing for authenticated users to execute scripts against the SolarWinds Orion IPAM web interface

Attack scenario:
1. http://[server name]/Orion/IPAM/IPAMSummaryView.aspx
2. Enter the following in the “Search for an IP address” field: “>
3. Click Search, which will redirect you to the following URL:http://[server name]/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E

Impact

An attacker with access to the SolarWinds Orion IPAM web interface can conduct a reflected cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

Apply Hotfix

The vendor has stated this vulnerability has been addressed in IPAM-v3.0-HotFix1. Users are advised to apply the hotfix. The vendor has stated this hotfix will be incorporated in the next version of IPAM v3.1, due this quarter and that customers under maintenance can get access to this hot fix via their SolarWinds Customer Portal.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing the SolarWinds Orion IPAM web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedSOLARWINDSAffected02 Aug 201231 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
3.5
AV:N/AC:M/Au:S/C:P/I:N/A:N

Temporal
2.7
E:POC/RL:W/RC:UC

Environmental
0.9
CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Anthony Trummer for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-4939

Date Public:
31 Oct 2012

Date First Published:
31 Oct 2012

Date Last Updated:
31 Oct 2012

Document Revision:
10

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#603276: OTRS contains a cross-site scripting vulnerability

Vulnerability Note VU#603276
OTRS contains a cross-site scripting vulnerability

Original Release date: 17 Oct 2012 | Last revised: 17 Oct 2012

Overview

Open Technology Real Services (OTRS) contains a cross-site scripting (XSS) (CWE-79) vulnerability in the body of HTML emails viewed within the OTRS application.

Description

OTRS is an open source Help Desk and ITIL® V3 compliant IT Service Management platform.

OTRS Security Advisory 2012-03 states:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10.

Impact

A remote attacker may be able to perform a cross-site scripting attack against a logged in OTRS user by sending a specifically crafted HTML email.

Solution

Apply an Update

OTRS 2.4.15, 3.0.17 and 3.1.11 were released to address this vulnerability.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedOTRSAffected07 Sep 201217 Oct 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal
3.9
E:POC/RL:OF/RC:C

Environmental
2.9
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/
http://www.otrs.com/en/open-source/community-news/releases-notes/
http://znuny.com/en/#!/advisory/ZSA-2012-03
http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to Mike Eduard of Znuny GmbH for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:
CVE-2012-4751

Date Public:
22 Oct 2012

Date First Published:
17 Oct 2012

Date Last Updated:
17 Oct 2012

Document Revision:
18

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#471364: Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities

Vulnerability Note VU#471364
Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities

Original Release date: 13 Sep 2012 | Last revised: 14 Sep 2012

Overview

Trend Micro InterScan Messaging Security Suite Version 7.1-Build_Win32_1394 has been reported to be susceptible to cross-site scripting and cross…

VU#143395: F5 Networks ASM appliance contains a cross-site scripting vulnerability

Vulnerability Note VU#143395
F5 Networks ASM appliance contains a cross-site scripting vulnerability

Original Release date: 10 Sep 2012 | Last revised: 10 Sep 2012

Overview

F5 Networks ASM appliance versions 10.0.0 through 11.2.0 HF2 are susceptible to a cross-site scripting vulnerability in the traffic overview page.

VU#777007: Ipswitch WhatsUp Gold 15.02 contains SQL injection and XSS vulnerabilities

Vulnerability Note VU#777007
Ipswitch WhatsUp Gold 15.02 contains SQL injection and XSS vulnerabilities

Original Release date: 04 Sep 2012 | Last revised: 04 Sep 2012

Overview

Ipswitch WhatsUp Gold 15.02 has been reported to contain blind SQL injection and cross-site scripting vulnerabilities.

Des…