72 lines
No EOL
2.9 KiB
Text
72 lines
No EOL
2.9 KiB
Text
IBM System Storage DS Storage Manager Profiler Multiple Vulnerabilities
|
||
|
||
|
||
Vendor: IBM Corporation
|
||
Product web page: http://www.ibm.com
|
||
Affected version: 4.8.6
|
||
|
||
Summary: Through its extraordinary flexibility, reliability, and performance,
|
||
the IBM® System Storage® series is designed to manage a broad scope of storage
|
||
workloads that exist in todays complex data center and do it effectively and
|
||
efficiently. This flagship IBM disk system can bring simplicity to your storage
|
||
environment by supporting a mix of random and sequential I/O workloads for a mix
|
||
of interactive and batch applications, regardless of whether they are running on
|
||
one of todays popular distributed server platforms or on the mainframe.
|
||
|
||
Desc: IBM System Storage DS Storage Manager Profiler suffers from an SQL Injection
|
||
and a Cross-Site Scripting (XSS) vulnerability. Input passed via the GET parameter
|
||
'selectedModuleOnly' in 'ModuleServlet.do' script is not properly sanitised before
|
||
being returned to the user or used in SQL queries. This can be exploited to manipulate
|
||
SQL queries by injecting arbitrary SQL code. The GET parameter 'updateRegn' in the
|
||
'SoftwareRegistration.do' script is vulnerable to a XSS issue where the attacker can
|
||
execute arbitrary HTML and script code in a user's browser session in context of an
|
||
affected site.
|
||
|
||
Tested on: Apache-Coyote/1.1
|
||
MySQL
|
||
|
||
|
||
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Vendor status:
|
||
|
||
[03.03.2012] Vulnerabilities discovered.
|
||
[19.04.2012] Reported vulnerability report to vendor.
|
||
[19.04.2012] Vendor acknowledges receipt of the vulnerability report.
|
||
[25.04.2012] Asked vendor for confirmation.
|
||
[26.04.2012] Vendor confirms the issues, working on mitigation plan.
|
||
[01.05.2012] Vendor promises that the updated package will be available in June timeframe.
|
||
[05.06.2012] Asked vendor for status update.
|
||
[07.06.2012] Vendor replies.
|
||
[15.06.2012] Vendor releases fix.
|
||
[20.06.2012] Coordinated public security advisory released.
|
||
|
||
|
||
Advisory ID: ZSL-2012-5094
|
||
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5094.php
|
||
|
||
IBM Advisory: https://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
|
||
IBM Fix: http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5090850&brandind=5000008&myns=x008&mync=R
|
||
|
||
ISS X-Force ID (SQLi): 75236
|
||
ISS X-Force URL: http://xforce.iss.net/xforce/xfdb/75236
|
||
|
||
ISS X-Force ID (XSS): 75239
|
||
ISS X-Force URL: http://xforce.iss.net/xforce/xfdb/75239
|
||
|
||
CVE ID (SQLi): CVE-2012-2171
|
||
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2171
|
||
|
||
CVE ID (XSS): CVE-2012-2172
|
||
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2172
|
||
|
||
|
||
03.03.2012
|
||
|
||
-----
|
||
|
||
XSS: http://10.1.0.3:9000/SoftwareRegistration.do?updateRegn="><script>alert(1);</script>
|
||
|
||
SQLi: http://10.1.0.3:9000/ModuleServlet?DeviceId=1&state=state_viewmodulelog&selectedModuleOnly=1[SQL QUERY]&selectedModule=1 |