lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 1 Dec 2014 08:49:37 +0000
From: <Stephan.Rickauer@...sscom.com>
To: <fulldisclosure@...lists.org>, <bugtraq@...urityfocus.com>
Subject: [FD] CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4

#############################################################
#
# SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security
#
#############################################################
#
# CVE ID:   CVE-2014-3809
# Product:  1830 Photonic Service Switch PSS-32/16/4
# Vendor:   Alcatel-Lucent
# Subject:  Reflected Cross-site Scripting - XSS
# Effect:   Remotely exploitable
# Author:   Stephan Rickauer (stephan.rickauer _at_ swisscom.com)
# Date:     December 1st 2014
#
#############################################################


Introduction:
-------------
Swisscom CSIRT discovered a security flaw in the management interface
of the Alcatel Lucent 1830 Photonic Service Switch series.


Vulnerable:
-----------
All Switches of Release 6.0 or lower are vulnerable.


Patches:
--------
None.


Description:
------------
The management interface of the 1830 Photonic Switch series is vulnerable
to reflected cross-site scripting, since user input is not properly encoded
on output. Exploiting this vulnerability will lead to so-called cross-site
scripting (XSS) and allows the impersonation of logged-in admin users.
Additionally, the myurl-Parameter accepts non-local web addresses, which
can be abused to redirect victims to arbitrary web sites.


Attack vector:
--------------
https://xx.xx.xx.xx/menu/pop.html?myurl=);<script>alert('xss')</script>


Statement Vendor:
-----------------
"The vulnerability is assessed at no risk. We will evaluate if/when we
will add the best practice of validating all inputs in WebUI tasks, but
this is not considered high priority for the roadmap."


Milestones:
-----------
May 21st 2014   Vulnerability discovered
May 21st 2014   CVE requested
June 13th 2014  Vendor contact established and provided with technical details
June 16th 2014  Vendor acknowledged issue (Psirt.Security at alcatel-lucent.com)
Aug. 28th 2014  Vendor update requested
Okt. 1st 2014   Vendor update requested
Dec. 1st 2014   Vendor update requested
Dec. 1st 2014   Vendor assess XSS not to be an issue
Dec. 1st 2014   Public release of advisory

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5309 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists