Hitachi Web Server 'imagemap' Cross-Site Scripting Vulnerability

Bugtraq ID:	26861
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 13 2007 12:00AM
Updated:	Jul 12 2010 07:17PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Hitachi Web Server 03-10-01 (Windows) Hitachi Web Server 03-10 (Windows) Hitachi Web Server 03-10 (Linux) Hitachi Web Server 03-10 (AIX) Hitachi Web Server 03-00-03 (Windows) Hitachi Web Server 03-00-01 (Linux) Hitachi Web Server 03-00-01 (Linux IPF) Hitachi Web Server 03-00-01 (AIX) Hitachi Web Server 03-00 (Windows) Hitachi Web Server 03-00 (Solaris) Hitachi Web Server 03-00 (Linux) Hitachi Web Server 03-00 (Linux IPF) Hitachi Web Server 03-00 (HP-UX) Hitachi Web Server 03-00 (HP-UX IPF) Hitachi Web Server 03-00 (AIX) Hitachi Web Server 02-06-/A (Linux) Hitachi Web Server 02-04-/D (Windows) Hitachi Web Server 02-04-/C (Linux IPF) Hitachi Web Server 02-04-/B (Solaris) Hitachi Web Server 02-04-/B (HP-UX) Hitachi Web Server 02-04-/B (HP-UX IPF) Hitachi Web Server 02-04-/B (AIX) Hitachi Web Server 02-04-/A (Windows IP Hitachi Web Server 02-03 (Windows IPF) Hitachi Web Server 02-02 (Linux) Hitachi Web Server 02-02 (Linux IPF) Hitachi Web Server 02-02 (HP-UX IPF) Hitachi Web Server 02-00-/A (Linux) Hitachi Web Server 02-00 (Windows) Hitachi Web Server 02-00 (Solaris) Hitachi Web Server 02-00 (Linux) Hitachi Web Server 02-00 (Linux AP8000) Hitachi Web Server 02-00 (HP-UX) Hitachi Web Server 02-00 (AIX) Hitachi Web Server 01-02-/E (AIX) Hitachi Web Server 01-02-/D (Solaris) Hitachi Web Server 01-02-/D (HP-UX) Hitachi Web Server 01-02 (AIX) Hitachi Web Server 01-01-/D (Linux) Hitachi Web Server 01-01 (Linux) Hitachi Web Server 01-01 (Linux MP) Hitachi Web Server 01-00 (Solaris) Hitachi Web Server 01-00 (HP-UX) Hitachi uCosminexus Service Platform 7 Hitachi uCosminexus Service Platform 07-50-01 (Windows) Hitachi uCosminexus Service Platform 07-50 (Windows) Hitachi uCosminexus Service Platform 07-50 (Linux) Hitachi uCosminexus Service Platform 07-20-01 (Windows) Hitachi uCosminexus Service Platform 07-20 (Windows) Hitachi uCosminexus Service Platform 07-10-06 (Linux) Hitachi uCosminexus Service Platform 07-10-06 (AIX) Hitachi uCosminexus Service Platform 07-10-01 (Windows) Hitachi uCosminexus Service Platform 07-10-01 (Linux(IPF) Hitachi uCosminexus Service Platform 07-10 (Windows) Hitachi uCosminexus Service Platform 07-10 (Linux) Hitachi uCosminexus Service Platform 07-10 (Linux(IPF)) Hitachi uCosminexus Service Platform 07-10 (AIX) Hitachi uCosminexus Service Platform 07-00-12 (Linux) Hitachi uCosminexus Service Platform 07-00-03 (Windows) Hitachi uCosminexus Service Platform 07-00-03 (Linux) Hitachi uCosminexus Service Platform 07-00-03 (AIX) Hitachi uCosminexus Service Platform 07-00 (Windows) Hitachi uCosminexus Service Platform 07-00 (Linux) Hitachi uCosminexus Service Platform 0 Hitachi uCosminexus Service Architect 7 Hitachi uCosminexus Service Architect 07-50-01 (Windows) Hitachi uCosminexus Service Architect 07-50 (Windows) Hitachi uCosminexus Service Architect 07-20-01 (Windows) Hitachi uCosminexus Service Architect 07-20 (Windows) Hitachi uCosminexus Service Architect 07-10-01 (Windows) Hitachi uCosminexus Service Architect 07-10 (Windows) Hitachi uCosminexus Service Architect 07-00-03 (Windows) Hitachi uCosminexus Service Architect 07-00-03 (Linux) Hitachi uCosminexus Service Architect 07-00-03 (AIX) Hitachi uCosminexus Service Architect 07-00 (Windows) Hitachi uCosminexus Service Architect 0 Hitachi uCosminexus Developer Standard 7 Hitachi uCosminexus Developer Standard 6.7 Hitachi uCosminexus Developer Standard 07-50-01 (Windows) Hitachi uCosminexus Developer Standard 07-50 (Windows) Hitachi uCosminexus Developer Standard 0 Hitachi uCosminexus Developer Professional 7 Hitachi uCosminexus Developer Professional 6.7 Hitachi uCosminexus Developer Professional 07-50-01 (Windows) Hitachi uCosminexus Developer Professional 07-50 (Windows) Hitachi uCosminexus Developer Professional 0 Hitachi uCosminexus Developer Light 6.7 Hitachi uCosminexus Developer Light 0 Hitachi uCosminexus Developer 07-50-01 (Windows) Hitachi uCosminexus Developer 07-50 (Windows) Hitachi uCosminexus Developer 07-20-01 (Windows) Hitachi uCosminexus Developer 07-20 (Windows) Hitachi uCosminexus Developer 07-10-01 (Windows) Hitachi uCosminexus Developer 07-10 (Windows) Hitachi uCosminexus Developer 07-00-03 (Windows) Hitachi uCosminexus Developer 07-00-03 (Linux) Hitachi uCosminexus Developer 07-00-03 (AIX) Hitachi uCosminexus Developer 07-00 (Windows) Hitachi uCosminexus Application Server Standard Version 6 Hitachi uCosminexus Application Server Standard 7 Hitachi uCosminexus Application Server Standard 6.7 Hitachi uCosminexus Application Server Standard 07-50-01 (Windows) Hitachi uCosminexus Application Server Standard 07-50-01 (Linux) Hitachi uCosminexus Application Server Standard 07-50-01 (AIX) Hitachi uCosminexus Application Server Standard 07-50 (Windows) Hitachi uCosminexus Application Server Standard 07-50 (Linux) Hitachi uCosminexus Application Server Standard 07-50 (AIX) Hitachi uCosminexus Application Server Standard 07-10-01 HP-UX(IPF) Hitachi uCosminexus Application Server Standard 07-10 (Linux) Hitachi uCosminexus Application Server Standard 07-10 (Linux(IPF)) Hitachi uCosminexus Application Server Standard 07-10 (HP-UX) Hitachi uCosminexus Application Server Standard 07-10 (HP-UX(IPF)) Hitachi uCosminexus Application Server Standard 07-00-03 (Windows) Hitachi uCosminexus Application Server Standard 07-00-02 (Windows) Hitachi uCosminexus Application Server Standard 07-00-01 (Windows) Hitachi uCosminexus Application Server Standard 07-00-01 (Linux) Hitachi uCosminexus Application Server Standard 07-00 (Windows) Hitachi uCosminexus Application Server Standard 07-00 (Solaris) Hitachi uCosminexus Application Server Standard 07-00 (Linux) Hitachi uCosminexus Application Server Standard 07-00 (HP-UX(IPF)) Hitachi uCosminexus Application Server Standard 07-00 (AIX) Hitachi uCosminexus Application Server Standard 06-72-/G(HP-UX(IPF)) Hitachi uCosminexus Application Server Standard 06-72-/D (AIX) Hitachi uCosminexus Application Server Standard 06-72-/C (Solaris) Hitachi uCosminexus Application Server Standard 06-72-/B(*1) (Linux) Hitachi uCosminexus Application Server Standard 06-72(*1) (HP-UX) Hitachi uCosminexus Application Server Standard 06-71-/B (Linux) Hitachi uCosminexus Application Server Standard 06-71 (Linux) Hitachi uCosminexus Application Server Standard 06-70-/D (AIX) Hitachi uCosminexus Application Server Standard 06-70-/C (Solaris) Hitachi uCosminexus Application Server Standard 06-70-/B(Linux(IPF)) Hitachi uCosminexus Application Server Standard 06-70-/B(*1) (Linux) Hitachi uCosminexus Application Server Standard 06-70-/B (Solaris) Hitachi uCosminexus Application Server Standard 06-70-/B (HP-UX) Hitachi uCosminexus Application Server Standard 06-70-/B (AIX) Hitachi uCosminexus Application Server Standard 06-70-/A (Solaris) Hitachi uCosminexus Application Server Standard 06-70-/A (AIX) Hitachi uCosminexus Application Server Standard 06-70 (Solaris) Hitachi uCosminexus Application Server Standard 02-00 (Windows) Hitachi uCosminexus Application Server Standard 0 Hitachi uCosminexus Application Server Smart Edition 0 Hitachi uCosminexus Application Server Enterprise Version 6 Hitachi uCosminexus Application Server Enterprise 7 Hitachi uCosminexus Application Server Enterprise 6.7 Hitachi uCosminexus Application Server Enterprise 09-80 (Windows(x64)) Hitachi uCosminexus Application Server Enterprise 07-50-01 (Windows) Hitachi uCosminexus Application Server Enterprise 07-50-01 (Linux) Hitachi uCosminexus Application Server Enterprise 07-50-01 (AIX) Hitachi uCosminexus Application Server Enterprise 07-50 (Windows) Hitachi uCosminexus Application Server Enterprise 07-50 (Linux) Hitachi uCosminexus Application Server Enterprise 07-50 (AIX) Hitachi uCosminexus Application Server Enterprise 07-10-1 (Linux(IPF)) Hitachi uCosminexus Application Server Enterprise 07-10-08 (HP-UX(IPF) Hitachi uCosminexus Application Server Enterprise 07-10-06 (Linux(IPF) Hitachi uCosminexus Application Server Enterprise 07-10-01 HP-UX(IPF) Hitachi uCosminexus Application Server Enterprise 07-10 HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 07-10 (Linux) Hitachi uCosminexus Application Server Enterprise 07-10 (Linux(IPF)) Hitachi uCosminexus Application Server Enterprise 07-10 (HP-UX) Hitachi uCosminexus Application Server Enterprise 07-10 (HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 07-10 (AIX) Hitachi uCosminexus Application Server Enterprise 07-10 Hitachi uCosminexus Application Server Enterprise 07-00-12 (HP-UX(IPF) Hitachi uCosminexus Application Server Enterprise 07-00-03 (Windows) Hitachi uCosminexus Application Server Enterprise 07-00-02 (Windows) Hitachi uCosminexus Application Server Enterprise 07-00-01 (Windows) Hitachi uCosminexus Application Server Enterprise 07-00-01 (Linux) Hitachi uCosminexus Application Server Enterprise 07-00 HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 07-00 (Windows) Hitachi uCosminexus Application Server Enterprise 07-00 (Solaris) Hitachi uCosminexus Application Server Enterprise 07-00 (Linux) Hitachi uCosminexus Application Server Enterprise 07-00 (HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 07-00 (AIX) Hitachi uCosminexus Application Server Enterprise 06-72-/G(HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 06-72-/B(Linux(IPF)) Hitachi uCosminexus Application Server Enterprise 06-72-/B (Linux) Hitachi uCosminexus Application Server Enterprise 06-72(*1) (HP-UX) Hitachi uCosminexus Application Server Enterprise 06-71-/C (Solaris) Hitachi uCosminexus Application Server Enterprise 06-71-/B (Linux) Hitachi uCosminexus Application Server Enterprise 06-71-/B (HP-UX) Hitachi uCosminexus Application Server Enterprise 06-71 (Linux) Hitachi uCosminexus Application Server Enterprise 06-70-/G(HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 06-70-/D (AIX) Hitachi uCosminexus Application Server Enterprise 06-70-/B(Linux(IPF)) Hitachi uCosminexus Application Server Enterprise 06-70-/B(HP-UX(IPF)) Hitachi uCosminexus Application Server Enterprise 06-70-/B(*1) (Linux) Hitachi uCosminexus Application Server Enterprise 06-70-/B (Solaris) Hitachi uCosminexus Application Server Enterprise 06-70-/B (AIX) Hitachi uCosminexus Application Server Enterprise 06-70-/A (Solaris) Hitachi uCosminexus Application Server Enterprise 06-70-/A (AIX) Hitachi uCosminexus Application Server Enterprise 06-70 (Solaris) Hitachi uCosminexus Application Server Enterprise 06-70 (AIX) Hitachi uCosminexus Application Server Enterprise 02-00 (Windows) Hitachi uCosminexus Application Server Enterprise 02-00 Hitachi uCosminexus Application Server 07-50-01 (Windows) Hitachi uCosminexus Application Server 07-50 (Windows) Hitachi uCosminexus Application Server 07-20-01 (Windows) Hitachi uCosminexus Application Server 07-20 (Windows) Hitachi uCosminexus Application Server 07-10-08 (HP-UX) Hitachi uCosminexus Application Server 07-10-08 (HP-UX(IPF) Hitachi uCosminexus Application Server 07-10-06 (Linux) Hitachi uCosminexus Application Server 07-10-06 (Linux(IPF) Hitachi uCosminexus Application Server 07-10-06 (AIX) Hitachi uCosminexus Application Server 07-10-01 (Windows) Hitachi uCosminexus Application Server 07-10-01 (Linux(IPF) Hitachi uCosminexus Application Server 07-10-01 (HP-UX(IPF) Hitachi uCosminexus Application Server 07-10 (Windows) Hitachi uCosminexus Application Server 07-10 (Linux) Hitachi uCosminexus Application Server 07-10 (Linux(IPF)) Hitachi uCosminexus Application Server 07-10 (HP-UX) Hitachi uCosminexus Application Server 07-10 (HP-UX(IPF)) Hitachi uCosminexus Application Server 07-00-12 (Solaris) Hitachi uCosminexus Application Server 07-00-12 (Linux) Hitachi uCosminexus Application Server 07-00-12 (HP-UX(IPF) Hitachi uCosminexus Application Server 07-00-12 (AIX) Hitachi uCosminexus Application Server 07-00-03 (Windows) Hitachi uCosminexus Application Server 07-00-03 (Linux) Hitachi uCosminexus Application Server 07-00-03 (AIX) Hitachi uCosminexus Application Server 07-00-01 (Solaris) Hitachi uCosminexus Application Server 07-00-01 (Linux) Hitachi uCosminexus Application Server 07-00 (Windows) Hitachi uCosminexus Application Server 07-00 (Solaris) Hitachi uCosminexus Application Server 07-00 (Linux) Hitachi uCosminexus Application Server 07-00 (HP-UX(IPF)) Hitachi uCosminexus Application Server 07-00 (AIX) Hitachi uCosminexus Application Server 06-71-/D (Windows) Hitachi uCosminexus Application Server 06-71-/D (Linux) Hitachi uCosminexus Application Server 06-71-/C (Linux) Hitachi uCosminexus Application Server 06-70-/J (HP-UX(IPF) Hitachi uCosminexus Application Server 06-70-/I (HP-UX(IPF) Hitachi uCosminexus Application Server 06-70-/E (AIX) Hitachi uCosminexus Application Server 06-70-/D (Windows Hitachi uCosminexus Application Server 06-70-/D (Solaris) Hitachi uCosminexus Application Server 06-70-/D (Linux) Hitachi uCosminexus Application Server 06-70-/C (Linux(IPF) Hitachi uCosminexus Application Server 06-70-/C (HP-UX)
Not Vulnerable:	Hitachi Web Server 03-10-03 (Windows) Hitachi Web Server 03-10-01 (Linux) Hitachi Web Server 03-10-01 (AIX) Hitachi Web Server 03-00-05 (AIX) Hitachi Web Server 03-00-04 (Windows) Hitachi Web Server 03-00-02 (Linux) Hitachi Web Server 03-00-02 (Linux IPF) Hitachi Web Server 03-00-02 (AIX) Hitachi Web Server 02-06-/B (Linux) Hitachi Web Server 02-04-/E (Windows) Hitachi Web Server 02-04-/C (Solaris) Hitachi Web Server 02-04-/C (HP-UX) Hitachi Web Server 02-04-/C (HP-UX IPF) Hitachi Web Server 02-04-/C (AIX)

Hitachi Web Server 'imagemap' Cross-Site Scripting Vulnerability

Hitachi Web Server is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Hitachi Web Server 'imagemap' Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Hitachi Web Server 'imagemap' Cross-Site Scripting Vulnerability

Solution:
The vendor released updates to address this issue. Please see the referenced advisory for more information.

Hitachi Web Server 'imagemap' Cross-Site Scripting Vulnerability

References:

• Hitachi Device Manager Homepage ( Hitachi)
  
• HS07-042 Cross-Site Scripting Vulnerability in the Hitachi Web Server Imagemap F (Hitachi)