[Full-disclosure] SEC Consult SA-20130507-0 :: Multiple vulnerabilities in NetApp OnCommand System Manager
SEC Consult Vulnerability Lab Security Advisory 20130507-0 === title: Multiple vulnerabilities product: NetApp OnCommand System Manager vulnerable version: = 2.1 and =2.0.2 fixed version: 2.2 (only XSS fixed) CVE: CVE-2013-3320 (XSS) CVE-2013-3321 (File inclusion) CVE-2013-3322 (OS command execution) impact: medium homepage: http://www.netapp.com/ found: 2012-11-06 by: M. Heinzl SEC Consult Vulnerability Lab https://www.sec-consult.com/ === Vendor description: --- You don't need to be a storage expert to manage NetApp storage systems. Configuration and ongoing storage management are easy using the Web-based OnCommand® System Manager. System Manager is the simple yet powerful management solution for NetApp storage it'seasy for small to midsize businesses to use and efficient for large enterprises and service providers. Source: http://www.netapp.com/us/products/management-software/system-manager.html Vulnerability overview/description: --- NetApp OnCommand System Manager suffers from multiple permanent and reflective cross-site scripting vulnerabilities, a local file inclusion vulnerability as well as an OS command execution vulnerability. Malicious, authenticated users can exploit these flaws to change the contents of the displayed site, redirect the user to other sites, steal user credentials, execute system commands and read sensitive information. The vendor will not fix the file inclusion and OS command execution issues, as it is considered a design feature. Proof of concepts: - 1) Multiple Reflective Cross-Site Scripting Vulnerabilities (internal bug number 654355) - CVE-2013-3320 When configuring CIFS (Configuration Protocols CIFS Configuration Setup), JavaScript can be inserted into the parameters domain-name and value. Request (domain-name): POST /zapiServlet HTTP/1.1 Host: 127.0.0.1:1195 [...] netapp version=1.7 xmlns=http://www.netapp.com/filer/admin;cifs-setupauth-typeworkgroup/auth-typedomain-nameimg src=x onerror=alert(1) /domain-namesecurity-stylemultiprotocol/security-styleserver-nameFILER/server-name/cifs-setup/netapp Furthermore, when creating new LUNs or editing already existing ones (Storage LUNs (Create or Edit)), JavaScript can be inserted into the parameter comment. 2) Multiple permanent cross-site scripting vulnerabilities (internal bug number 654355) - CVE-2013-3320 When creating new users or editing already existing ones (Configuration Local Users and Groups Users (Create or Edit)), JavaScript can be inserted into the parameters full-name and comment. Request (full-name): POST /zapiServlet HTTP/1.1 Host: 127.0.0.1:1457 [...] netapp version=1.7 xmlns=http://www.netapp.com/filer/admin;useradmin-user-modifyuseradmin-useruseradmin-user-infofull-nametestimg src=x onerror=alert(1) /full-namecommenttest/commentnametest/namepassword-maximum-age4294967295/password-maximum-agepassword-minimum-age0/password-minimum-ageuseradmin-groupsuseradmin-group-infonameAdministrators/name/useradmin-group-info/useradmin-groups/useradmin-user-info/useradmin-user/useradmin-user-modify/netapp Furthermore, when creating new groups or editing already existing ones (Configuration Local Users and Groups Groups (Create or Edit)), JavaScript can be inserted into the parameter comment. When creating new shares or editing already existing ones (Storage Shares (Create or Edit)), JavaScript can be inserted into the parameter comment. 3) Local File Inclusion (internal bug number 654357) - CVE-2013-3321 * When retrieving log files through SnapMirror (Diagnostics SnapMirror Log), the path can be changed to read arbitrary files from the file system. 4) OS Command Execution (internal bug number 654360) - CVE-2013-3322 * When using the Halt/Reboot interface (Configuration System Tools Halt/Reboot), arbitrary OS commands can be injected. * To exploit these issues, the attacker must be authenticated as root. The vendor will not fix these issues, as it is considered a design feature. Hence no proof of concept will be included within this advisory. Vendor contact timeline: 2012-11-06: Contacting vendor through security-in...@netapp.com 2012-11-06: Initial vendor response 2012-11-07: Forwarding security advisory to vendor 2012-11-07: Vendor acknowledges that the advisory was received 2012-11-14: Asking vendor for a status update 2012-11-14: Vendor asks for more time to address the issues 2012-11-27: Asking vendor for a conference call to discuss further details 2012-11-28: Conference call scheduled for 12th
[Full-disclosure] HTP5 ezine released
HTP5 has been released, featuring: MIT/EDUCAUSE Linode Nmap Sucuri NIST/NVD Wireshark and two zerodays. Enjoy - http://straylig.ht/zines/HTP5/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] SEC Consult SA-20130507-0 :: Multiple vulnerabilities in NetApp OnCommand System Manager
On Tue, May 7, 2013 at 9:56 AM, SEC Consult Vulnerability Lab resea...@sec-consult.com wrote: To exploit these issues, the attacker must be authenticated as root. ??? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ MDVSA-2013:162 ] glibc
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2013:162 http://www.mandriva.com/en/support/security/ ___ Package : glibc Date: May 7, 2013 Affected: Enterprise Server 5.0 ___ Problem Description: Multiple vulnerabilities has been discovered and corrected in glibc: Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments (CVE-2012-0864). Multiple errors in glibc#039;s formatted printing functionality could allow an attacker to bypass FORTIFY_SOURCE protections and execute arbitrary code using a format string flaw in an application, even though these protections are expected to limit the impact of such flaws to an application abort (CVE-2012-3404, CVE-2012-3405, CVE-2012-3406). Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified related functions in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow (CVE-2012-3480). Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters (CVE-2013-0242). Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results (CVE-2013-1914). The updated packages have been patched to correct these issues. ___ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0864 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3404 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3405 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3406 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3480 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1914 ___ Updated Packages: Mandriva Enterprise Server 5: 87712654b036070964fb35385f398279 mes5/i586/glibc-2.8-1.20080520.5.9mnb2.i586.rpm eae25c5265ca4d2dab2dbf8b0450b6a5 mes5/i586/glibc-devel-2.8-1.20080520.5.9mnb2.i586.rpm 161b6288a6c2b13b299e6e7bdd699eae mes5/i586/glibc-doc-2.8-1.20080520.5.9mnb2.i586.rpm 08948383eccf30d736dfeaef53430eab mes5/i586/glibc-doc-pdf-2.8-1.20080520.5.9mnb2.i586.rpm 6f1ae9e591ed477bf56c7a3a1f7770be mes5/i586/glibc-i18ndata-2.8-1.20080520.5.9mnb2.i586.rpm 7beb9227ce1bbff7fe2848b5fad3b4ca mes5/i586/glibc-profile-2.8-1.20080520.5.9mnb2.i586.rpm 2451007d981f0314f675e7edd387003b mes5/i586/glibc-static-devel-2.8-1.20080520.5.9mnb2.i586.rpm e502bca8475975d9e2ce11eec93a10d2 mes5/i586/glibc-utils-2.8-1.20080520.5.9mnb2.i586.rpm 63241c1d294d1972b3d12206e4d38eb3 mes5/i586/nscd-2.8-1.20080520.5.9mnb2.i586.rpm 641edd61d4e607e9ccd4c5b3c8c790ac mes5/SRPMS/glibc-2.8-1.20080520.5.9mnb2.src.rpm Mandriva Enterprise Server 5/X86_64: 4c8e423f7ddc996f087e2fc304329b31 mes5/x86_64/glibc-2.8-1.20080520.5.9mnb2.x86_64.rpm e7d749c4c4ffdd3b8320ca4af0f1ed72 mes5/x86_64/glibc-devel-2.8-1.20080520.5.9mnb2.x86_64.rpm b5fb6b11ed3bb0ab2ad5168be6371457 mes5/x86_64/glibc-doc-2.8-1.20080520.5.9mnb2.x86_64.rpm f4392e4257f604bfb9baf17740e1cc7d mes5/x86_64/glibc-doc-pdf-2.8-1.20080520.5.9mnb2.x86_64.rpm 0cddcf4e1d98b60c892ca22741b08d11 mes5/x86_64/glibc-i18ndata-2.8-1.20080520.5.9mnb2.x86_64.rpm 301995478a3f943d5d0448cbc561e436 mes5/x86_64/glibc-profile-2.8-1.20080520.5.9mnb2.x86_64.rpm 395f0f667999586e57e296c6b867e616 mes5/x86_64/glibc-static-devel-2.8-1.20080520.5.9mnb2.x86_64.rpm 0595e256f6c1e2f2c7f94cca21fd4f35 mes5/x86_64/glibc-utils-2.8-1.20080520.5.9mnb2.x86_64.rpm ea48c2685180f722187736bc8a624e58 mes5/x86_64/nscd-2.8-1.20080520.5.9mnb2.x86_64.rpm 641edd61d4e607e9ccd4c5b3c8c790ac mes5/SRPMS/glibc-2.8-1.20080520.5.9mnb2.src.rpm ___ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages
[Full-disclosure] [ MDVSA-2013:163 ] glibc
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2013:163 http://www.mandriva.com/en/support/security/ ___ Package : glibc Date: May 7, 2013 Affected: Business Server 1.0 ___ Problem Description: Multiple vulnerabilities has been discovered and corrected in glibc: Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters (CVE-2013-0242). Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results (CVE-2013-1914). The updated packages have been patched to correct these issues. ___ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1914 ___ Updated Packages: Mandriva Business Server 1/X86_64: ec721ecac69f6bace0fec908ed45cf6d mbs1/x86_64/glibc-2.14.1-12.1.mbs1.x86_64.rpm 8d9c7b66f9b61da0c0e70141861529f8 mbs1/x86_64/glibc-devel-2.14.1-12.1.mbs1.x86_64.rpm 5a442d51c573ea1cc3593bf5b68c7e07 mbs1/x86_64/glibc-doc-2.14.1-12.1.mbs1.noarch.rpm 67ca31e66b41d88a169599fddcc628c3 mbs1/x86_64/glibc-doc-pdf-2.14.1-12.1.mbs1.noarch.rpm 8e2b8f84441470a05b513420641b0505 mbs1/x86_64/glibc-i18ndata-2.14.1-12.1.mbs1.x86_64.rpm 59226b1addf578c14a0c53e0731c37a3 mbs1/x86_64/glibc-profile-2.14.1-12.1.mbs1.x86_64.rpm 291cc63f1cd9a45ddf89455b133d06b4 mbs1/x86_64/glibc-static-devel-2.14.1-12.1.mbs1.x86_64.rpm 143e405ead8fa9a2f9184547ef6c75fc mbs1/x86_64/glibc-utils-2.14.1-12.1.mbs1.x86_64.rpm fecc2dd312e4513a89360927c579bccd mbs1/x86_64/nscd-2.14.1-12.1.mbs1.x86_64.rpm 180d09be78ca8fdfa5ca6ec1c514026a mbs1/SRPMS/glibc-2.14.1-12.1.mbs1.src.rpm ___ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com ___ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team security*mandriva.com -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRiQeOmqjQ0CJFipgRAgI5AKCdFyI/q4cEL7h8jQyu7m/6KMmzQQCfRt/X yvN2sdb9PK31dXX/cWwckNA= =hmEZ -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
