Sun Management Center Performance Reporting Module Cross Site Scripting Vulnerability
BID:33999
Info
Sun Management Center Performance Reporting Module Cross Site Scripting Vulnerability
| Bugtraq ID: | 33999 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 04 2009 12:00AM |
| Updated: | Mar 05 2009 05:06PM |
| Credit: | Sun |
| Vulnerable: |
Sun SunMC 3.6.1 Sun SunMC 4.0 |
| Not Vulnerable: | |
Discussion
Sun Management Center Performance Reporting Module Cross Site Scripting Vulnerability
Sun Management Center Performance Reporting module is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Sun Management Center Performance Reporting module is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Exploit / POC
Sun Management Center Performance Reporting Module Cross Site Scripting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user into following a malicious URI.
To exploit this issue, an attacker must entice an unsuspecting user into following a malicious URI.
Solution / Fix
Sun Management Center Performance Reporting Module Cross Site Scripting Vulnerability
Solution:
The vendor has released fixes. Please see the references for more information.
Sun SunMC 4.0
Sun SunMC 3.6.1
Solution:
The vendor has released fixes. Please see the references for more information.
Sun SunMC 4.0
-
Sun 138553-03
for Solaris 10 SPARC
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -138553-03-1 -
Sun 138554-03
for Solaris 10 x86
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -138554-03-1
Sun SunMC 3.6.1
-
Sun 125191-04
for Solaris 8 SPARC
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125191-04-1 -
Sun 125192-04
for Solaris 9 SPARC
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125192-04-1 -
Sun 125194-04
for Solaris 10 SPARC
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125194-04-1
References
Sun Management Center Performance Reporting Module Cross Site Scripting Vulnerability
References:
References: