 |
| Home Page |  |
CERT-FI:P.O. Box 313 Finnish Communications Regulatory Authority (FICORA):Itämerenkatu 3 A |
CERT-FI Advisory on IBM BladeCenter Advanced Management Module
DetailsSeveral Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerabilities have been found in the IBM
BladeCenter Advanced Management Module. CERT-FI coordinated the remediation efforts of these vulnerabilities. The CSRF vulnerabilities can be exploited by enticing a user to a specially modified www page. The user must be logged on to the web frontend of the management module to be exposed the the vulnerability. Additionally, the attacker must know the IP address of the management module. The exploitation of these vulnerabilities enables the attacker to execute administrative commands on the management module with the rights of the logged on user. Among the XSS vulnerabilities there is a persistent (Type 2) XSS vulnerability. In case of unsuccessful login attempt, the vulnerable application writes the usernames into the application's log page without input sanitation. The vulnerability can be exploited by using a specific username when attempting to login to the web-based management interface. The exploitation takes place when a logged in user visits the log page of the management application. The exploitation of this vulnerability enables the attacker to execute administrative commands on the management module with the rights of the logged on user who visited the log page. Vulnerability Coordination Information and AcknowledgementsCERT-FI has coordinated the release of this vulnerability between the vulnerability researcher and the affected vendor. CERT-FI would like to thank HEnri Lindberg fo Louhi Networks for reporting the vulnerability to us, and IBM for co-operation in the remediation efforts. Vendor Information
RemediationPatch the vulnerable software components according to the guidance published by the vendor. The vulnerability can additionally be mitigated by limiting the use of the management interface according the instructions of the vulnerability researcher. References
Contact InformationCERT-FI Vulnerability Coordination can be contacted as follows: Email: Telephone: Fax : Revision History:17 April 2009, 17:00: Published
|
|
