PT-2012-3585 · Dell+1 · Dell Ml6000+1

Published 2012-03-22 · Updated 2018-01-10 · CVE-2012-1841

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quantum Scalar i500 tape library versions prior to i7.0.3 (604G.GS00100) Dell ML6000 tape library versions prior to A20-00 (590G.GS00100)

Description The issue allows remote attackers to read arbitrary files via a full pathname in the file parameter of the logShow.htm page.

Recommendations For Quantum Scalar i500 tape library versions prior to i7.0.3 (604G.GS00100), update to version i7.0.3 (604G.GS00100) or later. For Dell ML6000 tape library versions prior to A20-00 (590G.GS00100), update to version A20-00 (590G.GS00100) or later. As a temporary workaround, consider restricting access to the logShow.htm page until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-1841

Affected Products

Dell Ml6000

Quantum Scalar I500

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-1841 · Security Note
• http://secunia.com/advisories/48403 · Note
• http://secunia.com/advisories/48453 · Note
• http://osvdb.org/80226 · Note
• http://kb.cert.org/vuls/id/MAPG-8NVRPY · Note
• http://kb.cert.org/vuls/id/913483 · Note
• http://kb.cert.org/vuls/id/MAPG-8NNKN8 · Note