IBM BladeCenter Advanced Management Module Multiple Remote Vulnerabilities
BID:34447
Info
IBM BladeCenter Advanced Management Module Multiple Remote Vulnerabilities
| Bugtraq ID: | 34447 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2009 12:00AM |
| Updated: | Apr 09 2009 12:00AM |
| Credit: | Henri Lindberg |
| Vulnerable: |
IBM BladeCenter Advanced Management Module 1.42 |
| Not Vulnerable: |
IBM BladeCenter Advanced Management Module 1.42U build BPET42U IBM BladeCenter Advanced Management Module 1.42U build BBET42U |
Discussion
IBM BladeCenter Advanced Management Module Multiple Remote Vulnerabilities
IBM BladeCenter Advanced Management Module is prone to the following remote vulnerabilities:
- An HTML-injection vulnerability
- A cross-site scripting vulnerability
- An information-disclosure vulnerability
- Multiple cross-site request-forgery vulnerabilities
An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and perform actions as an authenticated user of the application. Other attacks are also possible.
Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable.
IBM BladeCenter Advanced Management Module is prone to the following remote vulnerabilities:
- An HTML-injection vulnerability
- A cross-site scripting vulnerability
- An information-disclosure vulnerability
- Multiple cross-site request-forgery vulnerabilities
An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and perform actions as an authenticated user of the application. Other attacks are also possible.
Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable.
Exploit / POC
IBM BladeCenter Advanced Management Module Multiple Remote Vulnerabilities
To exploit some of these issues, attackers may use a browser. For other issues, attackers must entice unsuspecting victims to follow a malicious URI.
The following example data and proof of concept are available:
To exploit some of these issues, attackers may use a browser. For other issues, attackers must entice unsuspecting victims to follow a malicious URI.
The following example data and proof of concept are available:
Solution / Fix
IBM BladeCenter Advanced Management Module Multiple Remote Vulnerabilities
Solution:
Updates are available; please see the references for more information.
Solution:
Updates are available; please see the references for more information.
References
IBM BladeCenter Advanced Management Module Multiple Remote Vulnerabilities
References:
References: