PT-2012-3587 · Dell+1 · Dell Ml6000+1

Publicado 2012-03-22 · Atualizado 2018-01-10 · CVE-2012-1843

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Quantum Scalar i500 tape library versions prior to i7.0.3 (604G.GS00100) Dell ML6000 tape library versions prior to A20-00 (590G.GS00100)

Description A cross-site request forgery (CSRF) issue exists in the saveRestore.htm file, allowing remote attackers to hijack user authentication for requests that execute Linux commands via the fileName parameter. This is related to a command-injection issue.

Recommendations For Quantum Scalar i500 tape library versions prior to i7.0.3 (604G.GS00100), update to version i7.0.3 (604G.GS00100) or later. For Dell ML6000 tape library versions prior to A20-00 (590G.GS00100), update to version A20-00 (590G.GS00100) or later. As a temporary workaround, consider restricting access to the saveRestore.htm file and the fileName parameter to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-1843

Produtos afetados

Dell Ml6000

Quantum Scalar I500

Referências · 8

• http://osvdb.org/80227 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1843 · Nota de Segurança
• http://kb.cert.org/vuls/id/MAPG-8NVRPY · Nota
• http://kb.cert.org/vuls/id/913483 · Nota
• http://secunia.com/advisories/48403 · Nota
• http://secunia.com/advisories/48453 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74161 · Nota
• http://kb.cert.org/vuls/id/MAPG-8NNKN8 · Nota