Details of VAR-201112-0237

ID

VAR-201112-0237

CVE

CVE-2011-4835

TITLE

HS2 Directory Traversal Vulnerability

Trust: 1.6

sources: IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5661 // CNNVD: CNNVD-201112-270

DESCRIPTION

Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspecified vectors. HomeSeer HS2 home automation software web interface contains multiple vulnerabilities. An attacker can request a WEB page like http://ipaddress/example<script>alert(document.cookie)</script> to store JavaScript in In the log view page. Viewing the log file by the administrator can cause JavaScript to execute in the target browser. A successful CSRFG attack allows an attacker to run commands as an administrator user. An HTML-injection vulnerability. 2. A cross-site request-forgery vulnerability. 3. A directory-traversal vulnerability. Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible. HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: HomeSeer HS2 Cross-Site Request Forgery and Script Insertion Vulnerabilities SECUNIA ADVISORY ID: SA47191 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47191/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47191 RELEASE DATE: 2011-12-09 DISCUSS ADVISORY: http://secunia.com/advisories/47191/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47191/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47191 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been discovered in HomeSeer HS2, which can be exploited by malicious people to conduct cross-site request forgery and script insertion attacks. 1) Input passed via the URL is not properly sanitised before being used. 2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. execute commands on a system by tricking a user into visiting a malicious web site. The vulnerabilities are confirmed in version 2.5.0.23. SOLUTION: Filter malicious characters and character sequences in a proxy. Do not browse untrusted websites or follow untrusted links while logged in to the application. PROVIDED AND/OR DISCOVERED BY: US-CERT credits Silent Dream ORIGINAL ADVISORY: US-CERT (VU#796883): http://www.kb.cert.org/vuls/id/796883 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 4.32

sources: NVD: CVE-2011-4835 // CERT/CC: VU#796883 // JVNDB: JVNDB-2011-003473 // CNVD: CNVD-2011-5661 // CNVD: CNVD-2011-5220 // BID: 50978 // IVD: 64027988-1f7c-11e6-abef-000c29c66e3d // IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 107711

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.8

sources: IVD: 64027988-1f7c-11e6-abef-000c29c66e3d // IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5661 // CNVD: CNVD-2011-5220

AFFECTED PRODUCTS

vendor:	homeseer	model:	hs2	scope:	eq	version:	2.5.0.20	Trust: 4.1
vendor:	homeseer	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	homeseer hs2	model:	-	scope:	eq	version:	2.5.0.20	Trust: 0.4

sources: IVD: 64027988-1f7c-11e6-abef-000c29c66e3d // IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5661 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003473 // CNNVD: CNNVD-201112-270 // NVD: CVE-2011-4835

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2011-4835
value:	HIGH
Trust: 1.0
CARNEGIE MELLON:	VU#796883
value:	0.11
Trust: 0.8
NVD:	CVE-2011-4835
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2011-5661
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201112-270
value:	HIGH
Trust: 0.6
IVD:	64027988-1f7c-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2
IVD:	7d760000-463f-11e9-9e66-000c29342cb1
value:	HIGH
Trust: 0.2
IVD:	50614964-2354-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2011-4835
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2011-5661
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	64027988-1f7c-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	7d760000-463f-11e9-9e66-000c29342cb1
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	50614964-2354-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 64027988-1f7c-11e6-abef-000c29c66e3d // IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5661 // JVNDB: JVNDB-2011-003473 // CNNVD: CNNVD-201112-270 // NVD: CVE-2011-4835

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.8

sources: JVNDB: JVNDB-2011-003473 // NVD: CVE-2011-4835

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-270

TYPE

Path traversal

Trust: 1.2

sources: IVD: 64027988-1f7c-11e6-abef-000c29c66e3d // IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201112-270

CONFIGURATIONS

sources: JVNDB: JVNDB-2011-003473

PATCH

title:	HomeSeer Home Control Software HS2	url:	http://www.homeseer.com/products/software/hs_software.htm	Trust: 0.8
title:	HS2 directory traversal vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/37788	Trust: 0.6

sources: CNVD: CNVD-2011-5661 // JVNDB: JVNDB-2011-003473

EXTERNAL IDS

db:	CERT/CC	id:	VU#796883	Trust: 4.2
db:	NVD	id:	CVE-2011-4835	Trust: 3.9
db:	BID	id:	50978	Trust: 1.5
db:	CNNVD	id:	CNNVD-201112-270	Trust: 1.2
db:	CNVD	id:	CNVD-2011-5661	Trust: 1.0
db:	CNVD	id:	CNVD-2011-5220	Trust: 0.8
db:	JVNDB	id:	JVNDB-2011-003473	Trust: 0.8
db:	CNNVD	id:	CNNVD-201112-136	Trust: 0.6
db:	IVD	id:	64027988-1F7C-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	IVD	id:	7D760000-463F-11E9-9E66-000C29342CB1	Trust: 0.2
db:	IVD	id:	50614964-2354-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SECUNIA	id:	47191	Trust: 0.2
db:	PACKETSTORM	id:	107711	Trust: 0.1

sources: IVD: 64027988-1f7c-11e6-abef-000c29c66e3d // IVD: 7d760000-463f-11e9-9e66-000c29342cb1 // IVD: 50614964-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5661 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003473 // PACKETSTORM: 107711 // CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-270 // NVD: CVE-2011-4835

REFERENCES

url:	http://www.kb.cert.org/vuls/id/796883	Trust: 3.4
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4835	Trust: 1.4
url:	about vulnerability notes	Trust: 0.8
url:	contact us about this vulnerability	Trust: 0.8
url:	provide a vendor statement	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4835	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu796883/	Trust: 0.8
url:	http://www.securityfocus.com/bid/50978	Trust: 0.6
url:	http://www.homeseer.com/downloads/	Trust: 0.3
url:	http://secunia.com/advisories/47191/#comments	Trust: 0.1
url:	http://secunia.com/company/jobs/	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=47191	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/47191/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CERT/CC: VU#796883 // CNVD: CNVD-2011-5661 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003473 // PACKETSTORM: 107711 // CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-270 // NVD: CVE-2011-4835

CREDITS

Silent Dream

Trust: 0.9

sources: BID: 50978 // CNNVD: CNNVD-201112-136

SOURCES

db:	IVD	id:	64027988-1f7c-11e6-abef-000c29c66e3d
db:	IVD	id:	7d760000-463f-11e9-9e66-000c29342cb1
db:	IVD	id:	50614964-2354-11e6-abef-000c29c66e3d
db:	CERT/CC	id:	VU#796883
db:	CNVD	id:	CNVD-2011-5661
db:	CNVD	id:	CNVD-2011-5220
db:	BID	id:	50978
db:	JVNDB	id:	JVNDB-2011-003473
db:	PACKETSTORM	id:	107711
db:	CNNVD	id:	CNNVD-201112-136
db:	CNNVD	id:	CNNVD-201112-270
db:	NVD	id:	CVE-2011-4835

LAST UPDATE DATE

2024-08-14T13:49:02.189000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#796883	date:	2012-01-12T00:00:00
db:	CNVD	id:	CNVD-2011-5661	date:	2011-12-16T00:00:00
db:	CNVD	id:	CNVD-2011-5220	date:	2011-12-12T00:00:00
db:	BID	id:	50978	date:	2011-12-16T18:08:00
db:	JVNDB	id:	JVNDB-2011-003473	date:	2011-12-21T00:00:00
db:	CNNVD	id:	CNNVD-201112-136	date:	2011-12-12T00:00:00
db:	CNNVD	id:	CNNVD-201112-270	date:	2011-12-16T00:00:00
db:	NVD	id:	CVE-2011-4835	date:	2011-12-15T19:53:53.467

SOURCES RELEASE DATE

db:	IVD	id:	64027988-1f7c-11e6-abef-000c29c66e3d	date:	2011-12-12T00:00:00
db:	IVD	id:	7d760000-463f-11e9-9e66-000c29342cb1	date:	2011-12-16T00:00:00
db:	IVD	id:	50614964-2354-11e6-abef-000c29c66e3d	date:	2011-12-16T00:00:00
db:	CERT/CC	id:	VU#796883	date:	2011-12-08T00:00:00
db:	CNVD	id:	CNVD-2011-5661	date:	2011-12-16T00:00:00
db:	CNVD	id:	CNVD-2011-5220	date:	2011-12-12T00:00:00
db:	BID	id:	50978	date:	2011-12-08T00:00:00
db:	JVNDB	id:	JVNDB-2011-003473	date:	2011-12-21T00:00:00
db:	PACKETSTORM	id:	107711	date:	2011-12-09T02:50:59
db:	CNNVD	id:	CNNVD-201112-136	date:	1900-01-01T00:00:00
db:	CNNVD	id:	CNNVD-201112-270	date:	2011-12-16T00:00:00
db:	NVD	id:	CVE-2011-4835	date:	2011-12-15T03:57:35.167