Sign-up

ID

VAR-201112-0313


CVE

CVE-2011-3339


TITLE

plural SafeNet Product cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2011-003467

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the Admin Control Center in Sentinel HASP Run-time Environment 5.95 and earlier in SafeNet Sentinel HASP (formerly Aladdin HASP SRM) run-time installer before 6.x and SDK before 5.11, as used in 7 Technologies (7T) IGSS 7 and other products, when Firefox 2.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger write access to a configuration file. Safenet provides software protection and certificate management products, affected products Sentinel HASP, previously Aladdin HASP SRM is a digital certificate management program. 7T IGSS uses the SafeNet Sentinel HASP SDK for managing digital certificates. Special characters allow an attacker to build and inject HTML into a configuration file. Successful exploitation of the vulnerability allows an attacker to change the code in the configuration file. This vulnerability can be reproduced using Mozilla FIrefox 2.0, which is currently not triggered by current Mozilla Firefox, Microsoft Internet Explorer, Opera, and Google Chrome. SafeNet Sentinel HASP and 7T IGSS are prone to an HTML-injection vulnerability because they fail to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: SafeNet Sentinel HASP Admin Control Center Script Insertion Weakness SECUNIA ADVISORY ID: SA47349 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47349/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47349 RELEASE DATE: 2011-12-22 DISCUSS ADVISORY: http://secunia.com/advisories/47349/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47349/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47349 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A weakness has been reported in SafeNet Sentinel HASP Run-time Environment, which can be exploited by malicious users to conduct script insertion attacks. Successful exploitation requires a victim to view injected data using Mozilla Firefox version 2.0. The weakness is reported in version 5.95 and prior. SOLUTION: Apply patch (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Carlos Mario Penagos Hollman, Synapse-labs. ORIGINAL ADVISORY: SafeNet: http://www.safenet-inc.com/support-downloads/sentinel-drivers/CVE-2011-3339/ ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-11-314-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.7

sources: NVD: CVE-2011-3339 // JVNDB: JVNDB-2011-003467 // CNVD: CNVD-2011-5249 // BID: 51028 // IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 108116

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5249

AFFECTED PRODUCTS

vendor:safenetmodel:sentinel hasp sdkscope:lteversion:5.10

Trust: 1.8

vendor:7model:interactive graphical scada systemscope:eqversion:7

Trust: 1.7

vendor:7tmodel:igssscope:eqversion:7

Trust: 1.6

vendor:safenetmodel:sentinel hasp run-timescope:lteversion:5.95

Trust: 1.0

vendor:safenetmodel:sentinel hasp sdkscope:eqversion:5.10

Trust: 0.9

vendor:safenetmodel:sentinel hasp run-timescope:eqversion:5.95

Trust: 0.9

vendor:mozillamodel:firefoxscope:eqversion:2.0

Trust: 0.8

vendor:safenetmodel:sentinel hasp run-time environmentscope:lteversion:5.95

Trust: 0.8

vendor:safenetmodel:sentinel hasp sdkscope:neversion:5.11

Trust: 0.3

vendor:safenetmodel:sentinel hasp run-timescope:neversion:6.21

Trust: 0.3

vendor:igssmodel: - scope:eqversion:7

Trust: 0.2

vendor:sentinel hasp run timemodel: - scope:eqversion:*

Trust: 0.2

vendor:sentinel hasp sdkmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5249 // BID: 51028 // JVNDB: JVNDB-2011-003467 // CNNVD: CNNVD-201112-171 // NVD: CVE-2011-3339

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-3339
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-3339
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201112-171
value: MEDIUM

Trust: 0.6

IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2011-3339
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2011-003467 // CNNVD: CNNVD-201112-171 // NVD: CVE-2011-3339

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2011-003467 // NVD: CVE-2011-3339

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201112-171

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201112-171

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003467

PATCH
title:Top Pageurl:http://www.igss.com/
Trust: 0.8
title:Top Pageurl:http://www.mozilla.org/
Trust: 0.8
title:CVE-2011-3339url:http://www.safenet-inc.com/support-downloads/sentinel-drivers/CVE-2011-3339/
Trust: 0.8
title:SafeNet Sentinel HASP and 7T IGSS have patches for unspecified HTML injection vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/6261
Trust: 0.6
title:Sentinel_LDK_Run-time_setupurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=42168
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-5249 // 
            
            
            
            JVNDB: JVNDB-2011-003467 // 
            
            
            
            CNNVD: CNNVD-201112-171

EXTERNAL IDS
db:NVDid:CVE-2011-3339
Trust: 3.6
db:ICS CERTid:ICSA-11-314-01
Trust: 2.8
db:BIDid:51028
Trust: 1.9
db:CNVDid:CNVD-2011-5249
Trust: 0.8
db:CNNVDid:CNNVD-201112-171
Trust: 0.8
db:JVNDBid:JVNDB-2011-003467
Trust: 0.8
db:XFid:71789
Trust: 0.6
db:SECUNIAid:47349
Trust: 0.3
db:IVDid:4CEC4FCC-2354-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:108116
Trust: 0.1
sources:
            
            
            IVD: 4cec4fcc-2354-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2011-5249 // 
            
            
            
            BID: 51028 // 
            
            
            
            JVNDB: JVNDB-2011-003467 // 
            
            
            
            PACKETSTORM: 108116 // 
            
            
            
            CNNVD: CNNVD-201112-171 // 
            
            
            
            NVD: CVE-2011-3339

REFERENCES
url:http://www.us-cert.gov/control_systems/pdf/icsa-11-314-01.pdf
Trust: 2.8
url:http://www.safenet-inc.com/support-downloads/sentinel-drivers/cve-2011-3339/
Trust: 2.0
url:http://www.securityfocus.com/bid/51028
Trust: 1.6
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/71789
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3339
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3339
Trust: 0.8
url:http://www.safenet-inc.com/support-downloads/sentinel-drivers/cve-2011-3339/http
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/71789
Trust: 0.6
url:http://www.7t.dk/
Trust: 0.3
url:http://www3.safenet-inc.com/support/hasp.aspx
Trust: 0.3
url:http://secunia.com/advisories/47349/
Trust: 0.1
url:http://secunia.com/company/jobs/
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/47349/#comments
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=47349
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2011-5249 // 
            
            
            
            BID: 51028 // 
            
            
            
            JVNDB: JVNDB-2011-003467 // 
            
            
            
            PACKETSTORM: 108116 // 
            
            
            
            CNNVD: CNNVD-201112-171 // 
            
            
            
            NVD: CVE-2011-3339

CREDITS
ICS-CERT
Trust: 0.9
sources:
            
            
            BID: 51028 // 
            
            
            
            CNNVD: CNNVD-201112-171

SOURCES
db:IVDid:4cec4fcc-2354-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-5249
db:BIDid:51028
db:JVNDBid:JVNDB-2011-003467
db:PACKETSTORMid:108116
db:CNNVDid:CNNVD-201112-171
db:NVDid:CVE-2011-3339

LAST UPDATE DATE
2024-08-14T15:45:02.511000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2011-5249date:2011-12-14T00:00:00
db:BIDid:51028date:2011-12-12T00:00:00
db:JVNDBid:JVNDB-2011-003467date:2011-12-21T00:00:00
db:CNNVDid:CNNVD-201112-171date:2011-12-23T00:00:00
db:NVDid:CVE-2011-3339date:2017-08-29T01:30:10.287

SOURCES RELEASE DATE
db:IVDid:4cec4fcc-2354-11e6-abef-000c29c66e3ddate:2011-12-14T00:00:00
db:CNVDid:CNVD-2011-5249date:2011-12-14T00:00:00
db:BIDid:51028date:2011-12-12T00:00:00
db:JVNDBid:JVNDB-2011-003467date:2011-12-21T00:00:00
db:PACKETSTORMid:108116date:2011-12-22T08:52:38
db:CNNVDid:CNNVD-201112-171date:1900-01-01T00:00:00
db:NVDid:CVE-2011-3339date:2011-12-17T03:54:45.743