PT-2012-3587 · Dell+1 · Dell Ml6000+1

Published 2012-03-22 · Updated 2018-01-10 · CVE-2012-1843

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Quantum Scalar i500 tape library versions prior to i7.0.3 (604G.GS00100) Dell ML6000 tape library versions prior to A20-00 (590G.GS00100)

Description A cross-site request forgery (CSRF) issue exists in the saveRestore.htm file, allowing remote attackers to hijack user authentication for requests that execute Linux commands via the fileName parameter. This is related to a command-injection issue.

Recommendations For Quantum Scalar i500 tape library versions prior to i7.0.3 (604G.GS00100), update to version i7.0.3 (604G.GS00100) or later. For Dell ML6000 tape library versions prior to A20-00 (590G.GS00100), update to version A20-00 (590G.GS00100) or later. As a temporary workaround, consider restricting access to the saveRestore.htm file and the fileName parameter to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-1843

Affected Products

Dell Ml6000

Quantum Scalar I500

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2012-1843 · Security Note
• http://osvdb.org/80227 · Note
• http://kb.cert.org/vuls/id/MAPG-8NVRPY · Note
• http://kb.cert.org/vuls/id/913483 · Note
• http://secunia.com/advisories/48403 · Note
• http://secunia.com/advisories/48453 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74161 · Note
• http://kb.cert.org/vuls/id/MAPG-8NNKN8 · Note