full-disclosure - [FD] CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability

Open Source and information security mailing list archives

Date: Mon, 2 Feb 2015 09:45:26 +0100
From: Alex Haynes <alex_haynes@...look.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CVE-2014-5360 Landesk Management Suite XSS (Cross-Site
 Scripting) Security Vulnerability

CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability
Exploit Title: Landesk Management Suite Cross-Site scripting vulnerabilityProduct: Landesk Management SuiteVulnerable Versions: 9.5 (possible previous versions), 9.6Tested Version: 9.5Advisory Publication: Feb 02, 2015Latest Update: Feb 02, 2015Vulnerability Type: Cross-Site Scripting [CWE-79]CVE Reference: CVE-2014-5360Credit: Alex Haynes
Advisory Details:
(1) Vendor & Product Description--------------------------------
Vendor:LANDESK
Product & Version:Landesk Management Suite v9.5
Vendor URL & Download:http://www.landesk.com/products/management-suite/
Product Description:"Manage all your users’ multi-platform desktops and mobile devices. Integrate several IT disciplinesinto a single management experience that speeds software distribution, ensures software license compliance, simplifies OS provisioning, saves power costs, provides secure remote control, and manages Mac OS X."

(2) Vulnerability Details:--------------------------The admin interface of Landesk Management Suite can be exploited by XSS attacks.
Proof of concept:URL: https://<LANDESK>/remote/serverlist_grouptree.aspx?AMTVersion=+alert(5)Parameter name: AMTVersionParameter Type: GETAttack Pattern: +alert(5)
(3) Advisory Timeline:----------------------15/09/2014 - First Contact19/12/2014 - Vulnerability fixed02/02/2015 - Advisory released
(4)Solution:--------------Upgrade to version 9.6 SP1 which includes a fix for this vulnerability
(5) Credits:--------------Discovered by Alex Haynes
References:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5360 		 	   		  

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives