Sign-up

ID

VAR-200912-0136


CVE

CVE-2009-4196


TITLE

Huawei MT882 V100R002B020 ARG-T of Forms/ Cross-site scripting vulnerability in underlying script

Trust: 0.8

sources: JVNDB: JVNDB-2009-005178

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 allow remote attackers to inject arbitrary web script or HTML via the (1) BackButton parameter to error_1; (2) wzConnFlag parameter to fresh_pppoe_1; (3) diag_pppindex_argen and (4) DiagStartFlag parameters to rpDiag_argen_1; (5) wzdmz_active and (6) wzdmzHostIP parameters to rpNATdmz_argen_1; (7) wzVIRTUALSVR_endPort, (8) wzVIRTUALSVR_endPortLocal, (9) wzVIRTUALSVR_IndexFlag, (10) wzVIRTUALSVR_localIP, (11) wzVIRTUALSVR_startPort, and (12) wzVIRTUALSVR_startPortLocal parameters to rpNATvirsvr_argen_1; (13) Connect_DialFlag, (14) Connect_DialHidden, and (15) Connect_Flag parameters to rpStatus_argen_1; (16) Telephone_select, and (17) wzFirstFlag parameters to rpwizard_1; and (18) wzConnectFlag parameter to rpwizPppoe_1. (1) error_1 To BackButton Parameters (2) fresh_pppoe_1 To wzConnFlag Parameters (3) rpDiag_argen_1 To diag_pppindex_argen Parameters (4) rpDiag_argen_1 To DiagStartFlag Parameters (5) rpNATdmz_argen_1 To wzdmz_active Parameters (6) rpNATdmz_argen_1 To wzdmzHostIP Parameters (7) rpNATvirsvr_argen_1 To wzVIRTUALSVR_endPort Parameters (8) rpNATvirsvr_argen_1 To wzVIRTUALSVR_endPortLocal Parameters (9) rpNATvirsvr_argen_1 To wzVIRTUALSVR_IndexFlag Parameters (10) rpNATvirsvr_argen_1 To wzVIRTUALSVR_localIP Parameters (11) rpNATvirsvr_argen_1 To wzVIRTUALSVR_startPort Parameters (12) rpNATvirsvr_argen_1 To wzVIRTUALSVR_startPortLocal Parameters (13) rpStatus_argen_1 To Connect_DialFlag Parameters (14) rpStatus_argen_1 To Connect_DialHidden Parameters (15) rpStatus_argen_1 To Connect_Flag Parameters (16) rpwizard_1 To Telephone_select Parameters (17) rpwizard_1 To wzFirstFlag Parameters (18) rpwizPppoe_1 To wzConnectFlag Parameters. Huawei MT882 is prone to multiple cross-site scripting vulnerabilities and an information-disclosure vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also obtain sensitive information. Huawei MT882 firmware 3.7.9.98 is vulnerable; other versions may also be affected. Huawei MT882l is a small ADSL modem. Multiple scripts in Forms/ of the MT882l cat do not properly filter parameter requests submitted by users. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Huawei MT882 Multiple Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA37568 VERIFY ADVISORY: http://secunia.com/advisories/37568/ DESCRIPTION: DecodeX01 has reported multiple vulnerabilities in Huawei MT882, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "BackButton" parameter in Forms/error_1, "wzConnFlag" in Forms/fresh_pppoe_1, "diag_pppindex_argen" and "DiagStartFlag" in Forms/rpDiag_argen_1, "wzdmz_active" and "wzdmzHostIP" in Forms/rpNATdmz_argen_1, "wzVIRTUALSVR_endPort", "wzVIRTUALSVR_endPortLocal", "wzVIRTUALSVR_IndexFlag", "wzVIRTUALSVR_localIP", "wzVIRTUALSVR_startPort", and "wzVIRTUALSVR_startPortLocal" in Forms/rpNATvirsvr_argen_1, "Connect_DialFlag", "Connect_DialHidden", and "Connect_Flag" in Forms/rpStatus_argen_1, "Telephone_select" and "wzFirstFlag" in Forms/rpwizard_1, and "wzConnectFlag" in Forms/rpwizPppoe_1 is not properly sanitised before being returned to the user. The vulnerabilities are reported in version 3.7.9.98. SOLUTION: Filter malicious characters and character sequences in a proxy. PROVIDED AND/OR DISCOVERED BY: DecodeX01 ORIGINAL ADVISORY: http://www.exploit-db.com/exploits/10276 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2009-4196 // JVNDB: JVNDB-2009-005178 // BID: 37194 // VULHUB: VHN-41642 // PACKETSTORM: 83713

AFFECTED PRODUCTS

vendor:huaweimodel:mt882 v100t002b020 arg-tscope:eqversion:firmware_3.7.9.98

Trust: 1.6

vendor:huaweimodel:mt882 v100t002b020 arg-tscope:eqversion:firmware 3.7.9.98

Trust: 0.8

vendor:huaweimodel:mt882scope:eqversion:3.7.9.98

Trust: 0.3

sources: BID: 37194 // JVNDB: JVNDB-2009-005178 // CNNVD: CNNVD-200912-061 // NVD: CVE-2009-4196

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2009-4196
value: MEDIUM

Trust: 1.0

NVD: CVE-2009-4196
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200912-061
value: MEDIUM

Trust: 0.6

VULHUB: VHN-41642
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2009-4196
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-41642
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-41642 // JVNDB: JVNDB-2009-005178 // CNNVD: CNNVD-200912-061 // NVD: CVE-2009-4196

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-41642 // JVNDB: JVNDB-2009-005178 // NVD: CVE-2009-4196

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200912-061

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 83713 // CNNVD: CNNVD-200912-061

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2009-005178

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-41642

PATCH
title:Top Pageurl:http://www.huawei.com/en/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2009-005178

EXTERNAL IDS
db:NVDid:CVE-2009-4196
Trust: 2.8
db:BIDid:37194
Trust: 2.0
db:EXPLOIT-DBid:10276
Trust: 1.8
db:JVNDBid:JVNDB-2009-005178
Trust: 0.8
db:CNNVDid:CNNVD-200912-061
Trust: 0.7
db:XFid:54526
Trust: 0.6
db:SECUNIAid:37568
Trust: 0.2
db:VULHUBid:VHN-41642
Trust: 0.1
db:PACKETSTORMid:83713
Trust: 0.1
sources:
            
            
            VULHUB: VHN-41642 // 
            
            
            
            BID: 37194 // 
            
            
            
            JVNDB: JVNDB-2009-005178 // 
            
            
            
            PACKETSTORM: 83713 // 
            
            
            
            CNNVD: CNNVD-200912-061 // 
            
            
            
            NVD: CVE-2009-4196

REFERENCES
url:http://www.exploit-db.com/exploits/10276
Trust: 1.8
url:http://www.securityfocus.com/bid/37194
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/54526
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4196
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4196
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/54526
Trust: 0.6
url:http://www.huawei.com/
Trust: 0.3
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/business_solutions/
Trust: 0.1
url:http://secunia.com/advisories/37568/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-41642 // 
            
            
            
            BID: 37194 // 
            
            
            
            JVNDB: JVNDB-2009-005178 // 
            
            
            
            PACKETSTORM: 83713 // 
            
            
            
            CNNVD: CNNVD-200912-061 // 
            
            
            
            NVD: CVE-2009-4196

CREDITS
DecodeX01
Trust: 0.9
sources:
            
            
            BID: 37194 // 
            
            
            
            CNNVD: CNNVD-200912-061

SOURCES
db:VULHUBid:VHN-41642
db:BIDid:37194
db:JVNDBid:JVNDB-2009-005178
db:PACKETSTORMid:83713
db:CNNVDid:CNNVD-200912-061
db:NVDid:CVE-2009-4196

LAST UPDATE DATE
2024-11-23T22:14:29.764000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-41642date:2017-08-17T00:00:00
db:BIDid:37194date:2015-04-13T21:05:00
db:JVNDBid:JVNDB-2009-005178date:2012-09-25T00:00:00
db:CNNVDid:CNNVD-200912-061date:2009-12-07T00:00:00
db:NVDid:CVE-2009-4196date:2024-11-21T01:09:07.997

SOURCES RELEASE DATE
db:VULHUBid:VHN-41642date:2009-12-04T00:00:00
db:BIDid:37194date:2009-12-03T00:00:00
db:JVNDBid:JVNDB-2009-005178date:2012-09-25T00:00:00
db:PACKETSTORMid:83713date:2009-12-10T17:01:34
db:CNNVDid:CNNVD-200912-061date:2009-12-04T00:00:00
db:NVDid:CVE-2009-4196date:2009-12-04T11:30:00.780