Sign-up

ID

VAR-201105-0049


CVE

CVE-2011-0962


TITLE

Cisco Unified Operations Manager Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2011-003130

DESCRIPTION

Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712. The problem is Bug ID CSCto12712 It is a problem.Any third party, through the tag parameters, Web Script or HTML May be inserted. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. This issue is being tracked by Cisco Bug ID CSCto12712. Sense of Security - Security Advisory - SOS-11-006 Release Date. 18-May-2011 Last Update. - Vendor Notification Date. 28-Feb-2011 Product. Platform. Microsoft Windows Affected versions. CuOM 8.0 and 8.5 (verified), possibly others. Severity Rating. Medium - Low Impact. Database access, cookie and credential theft, impersonation, loss of confidentiality, local file disclosure, information disclosure. Attack Vector. Remote with authentication Solution Status. Vendor patch (upgrade to CuOM 8.6 as advised by Cisco) CVE reference. CVE-2011-0959 (CSCtn61716) CVE-2011-0960 (CSCtn61716) CVE-2011-0961 (CSCto12704) CVE-2011-0962 (CSCto12712) CVE-2011-0966 (CSCto35577) Details. Operations Manager monitors and evaluates the current status of both the IP communications infrastructure and the underlying transport infrastructure in your network. These vulnerabilities include multiple blind SQL injections, multiple XSS. and a directory traversal vulnerability. 1. Blind SQL injection vulnerabilities that affect CuOM CVE-2011-0960 (CSCtn61716): The Variable CCMs of PRTestCreation can trigger a blind SQL injection vulnerability by supplying a single quote, followed by a time delay call: /iptm/PRTestCreation.do?RequestSource=dashboard&MACs=&CCMs='waitfor%20 delay'0:0:20'--&Extns=&IPs= Additionally, variable ccm of TelePresenceReportAction can trigger a blind SQL injection vulnerability by supplying a single quote: /iptm/TelePresenceReportAction.do?ccm='waitfor%20delay'0:0:20'-- 2. Directory traversal vulnerability that affects CiscoWorks Homepage CVE-2011-0966 (CSCto35577): http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\boot.ini cmfDBA user database info: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope rties DB connection info for all databases: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper ties Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example. DB password change log: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\log\dbpwdChange.log Solution. Upgrade to CuOM 8.6. Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and CSCto35577 for information on patches and availability of fixes. Discovered by. Sense of Security Labs. About us. Sense of Security is a leading provider of information security and risk management solutions. Our team has expert skills in assessment and assurance, strategy and architecture, and deployment through to ongoing management. We are Australia's premier application penetration testing firm and trusted IT security advisor to many of the countries largest organisations. Sense of Security Pty Ltd Level 8, 66 King St Sydney NSW 2000 AUSTRALIA T: +61 (0)2 9290 4444 F: +61 (0)2 9290 4455 W: http://www.senseofsecurity.com.au E: info@senseofsecurity.com.au Twitter: @ITsecurityAU The latest version of this advisory can be found at: http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf Other Sense of Security advisories can be found at: http://www.senseofsecurity.com.au/research/it-security-advisories.php . ---------------------------------------------------------------------- http://twitter.com/secunia http://www.facebook.com/Secunia ---------------------------------------------------------------------- TITLE: Cisco Unified Operations Manager Cross-Site Scripting and SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA44597 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44597/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44597 RELEASE DATE: 2011-05-20 DISCUSS ADVISORY: http://secunia.com/advisories/44597/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44597/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44597 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Some vulnerabilities have been reported in Cisco Unified Operations Manager, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks. 1) Input passed via the "CCMs" parameter to iptm/PRTestCreation.do and the "ccm" parameter to iptm/TelePresenceReportAction.do is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 2) Input passed via various parameters to multiple scripts is not properly sanitised before being returned to the user. Examples: http://[host]/iptm/advancedfind.do?extn=[code] http://[host]/iptm/ddv.do?deviceCapability=deviceCap&deviceInstanceName=[code] http://[host]/iptm/eventmon?viewname=device.filter&operation=getFilter&cmd=[code] http://[host]/iptm/eventmon?cmd=getDeviceData&group=[code] http://[host]/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?clusterName=[code] http://[host]/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?deviceName=[code] http://[host]/iptm/logicalTopo.do?ccmName=[code] http://[host]/iptm/logicalTopo.do?clusterName=[code] 3) Input passed via the "tag" parameter to CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in Common Services Device Center is not properly sanitised before being returned to the user. The vulnerabilities are reported in versions 8.0 and 8.5. SOLUTION: Updated to version 8.6. PROVIDED AND/OR DISCOVERED BY: Sense of Security Labs ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=23085 http://tools.cisco.com/security/center/viewAlert.x?alertId=23086 http://tools.cisco.com/security/center/viewAlert.x?alertId=23087 Sense of Security Labs: http://www.senseofsecurity.com.au/advisories/SOS-11-006 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor

Trust: 2.7

sources: NVD: CVE-2011-0962 // JVNDB: JVNDB-2011-003130 // CNVD: CNVD-2011-1911 // BID: 47903 // VULHUB: VHN-48907 // PACKETSTORM: 101518 // PACKETSTORM: 101570

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2011-1911

AFFECTED PRODUCTS

vendor:ciscomodel:unified operations managerscope:eqversion:2.1

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:2.2

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:2.3

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:8.0

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:2.0.1

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:2.0.2

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:2.0.3

Trust: 2.5

vendor:ciscomodel:unified operations managerscope:eqversion:2.0

Trust: 1.6

vendor:ciscomodel:unified operations managerscope:eqversion:1.1

Trust: 1.6

vendor:ciscomodel:unified operations managerscope:eqversion:8.5

Trust: 1.5

vendor:ciscomodel:unified operations managerscope:lteversion:8.5

Trust: 1.0

vendor:ciscomodel:unified operations manager sp1scope:eqversion:2.1

Trust: 0.9

vendor:ciscomodel:unified operations managerscope:ltversion:8.6

Trust: 0.8

vendor:ciscomodel:unified operations managerscope:neversion:8.6

Trust: 0.3

sources: CNVD: CNVD-2011-1911 // BID: 47903 // JVNDB: JVNDB-2011-003130 // CNNVD: CNNVD-201105-208 // NVD: CVE-2011-0962

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0962
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-0962
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201105-208
value: MEDIUM

Trust: 0.6

VULHUB: VHN-48907
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-0962
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-48907
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-48907 // JVNDB: JVNDB-2011-003130 // CNNVD: CNNVD-201105-208 // NVD: CVE-2011-0962

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-48907 // JVNDB: JVNDB-2011-003130 // NVD: CVE-2011-0962

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 101518 // CNNVD: CNNVD-201105-208

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201105-208

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003130

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-48907

PATCH
title:23087url:http://tools.cisco.com/security/center/viewAlert.x?alertId=23087
Trust: 0.8
title:Patch for Cisco Unified Operations Manager Common Services Device Center Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/3889
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-1911 // 
            
            
            
            JVNDB: JVNDB-2011-003130

EXTERNAL IDS
db:NVDid:CVE-2011-0962
Trust: 3.5
db:EXPLOIT-DBid:17304
Trust: 1.7
db:JVNDBid:JVNDB-2011-003130
Trust: 0.8
db:CNNVDid:CNNVD-201105-208
Trust: 0.7
db:SECUNIAid:44597
Trust: 0.7
db:CNVDid:CNVD-2011-1911
Trust: 0.6
db:XFid:67524
Trust: 0.6
db:FULLDISCid:20110518 CISCO UNIFIED OPERATIONS MANAGER MULTIPLE VULNERABILITIES - SOS-11-006
Trust: 0.6
db:BIDid:47903
Trust: 0.4
db:EXPLOIT-DBid:35780
Trust: 0.1
db:VULHUBid:VHN-48907
Trust: 0.1
db:PACKETSTORMid:101518
Trust: 0.1
db:PACKETSTORMid:101570
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2011-1911 // 
            
            
            
            VULHUB: VHN-48907 // 
            
            
            
            BID: 47903 // 
            
            
            
            JVNDB: JVNDB-2011-003130 // 
            
            
            
            PACKETSTORM: 101518 // 
            
            
            
            PACKETSTORM: 101570 // 
            
            
            
            CNNVD: CNNVD-201105-208 // 
            
            
            
            NVD: CVE-2011-0962

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=23087
Trust: 2.1
url:http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf
Trust: 1.8
url:http://www.exploit-db.com/exploits/17304
Trust: 1.7
url:http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/67524
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0962
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0962
Trust: 0.8
url:http://www.senseofsecurity.com.au/advisories/sos-11-006.pdfhttp
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/67524
Trust: 0.6
url:http://secunia.com/advisories/44597
Trust: 0.6
url:http://www.cisco.com/en/us/products/ps6535/index.html
Trust: 0.3
url:http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf 
Trust: 0.3
url:http://target:1741/cwhp/auditlog.do?file=..\..\..\..\..\..\..\program
Trust: 0.1
url:http://www.senseofsecurity.com.au
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0961
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0960
Trust: 0.1
url:http://www.senseofsecurity.com.au/research/it-security-advisories.php
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0962
Trust: 0.1
url:http://target:1741/cwhp/auditlog.do?file=..\..\..\..\..\..\..\boot.ini
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0966
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0959
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=44597
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://[host]/iptm/faultmon/ui/dojo/main/eventmon_wrapper.jsp?clustername=[code]
Trust: 0.1
url:http://secunia.com/advisories/44597/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://[host]/iptm/logicaltopo.do?clustername=[code]
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://[host]/iptm/ddv.do?devicecapability=devicecap&deviceinstancename=[code]
Trust: 0.1
url:http://www.senseofsecurity.com.au/advisories/sos-11-006
Trust: 0.1
url:http://secunia.com/advisories/44597/#comments
Trust: 0.1
url:http://twitter.com/secunia
Trust: 0.1
url:http://www.facebook.com/secunia
Trust: 0.1
url:http://[host]/iptm/advancedfind.do?extn=[code]
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=23085
Trust: 0.1
url:http://[host]/iptm/eventmon?viewname=device.filter&operation=getfilter&cmd=[code]
Trust: 0.1
url:http://[host]/iptm/logicaltopo.do?ccmname=[code]
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=23086
Trust: 0.1
url:http://[host]/iptm/eventmon?cmd=getdevicedata&group=[code]
Trust: 0.1
url:http://[host]/iptm/faultmon/ui/dojo/main/eventmon_wrapper.jsp?devicename=[code]
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2011-1911 // 
            
            
            
            VULHUB: VHN-48907 // 
            
            
            
            BID: 47903 // 
            
            
            
            JVNDB: JVNDB-2011-003130 // 
            
            
            
            PACKETSTORM: 101518 // 
            
            
            
            PACKETSTORM: 101570 // 
            
            
            
            CNNVD: CNNVD-201105-208 // 
            
            
            
            NVD: CVE-2011-0962

CREDITS
Sense of Security Labs.
Trust: 0.3
sources:
            
            
            BID: 47903

SOURCES
db:CNVDid:CNVD-2011-1911
db:VULHUBid:VHN-48907
db:BIDid:47903
db:JVNDBid:JVNDB-2011-003130
db:PACKETSTORMid:101518
db:PACKETSTORMid:101570
db:CNNVDid:CNNVD-201105-208
db:NVDid:CVE-2011-0962

LAST UPDATE DATE
2024-11-23T22:02:52.557000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2011-1911date:2011-05-19T00:00:00
db:VULHUBid:VHN-48907date:2017-08-17T00:00:00
db:BIDid:47903date:2011-05-18T00:00:00
db:JVNDBid:JVNDB-2011-003130date:2011-12-01T00:00:00
db:CNNVDid:CNNVD-201105-208date:2011-05-23T00:00:00
db:NVDid:CVE-2011-0962date:2024-11-21T01:25:12.723

SOURCES RELEASE DATE
db:CNVDid:CNVD-2011-1911date:2011-05-19T00:00:00
db:VULHUBid:VHN-48907date:2011-05-20T00:00:00
db:BIDid:47903date:2011-05-18T00:00:00
db:JVNDBid:JVNDB-2011-003130date:2011-12-01T00:00:00
db:PACKETSTORMid:101518date:2011-05-18T14:17:13
db:PACKETSTORMid:101570date:2011-05-20T05:48:10
db:CNNVDid:CNNVD-201105-208date:2011-05-20T00:00:00
db:NVDid:CVE-2011-0962date:2011-05-20T22:55:03.033