Symantec IM Manager Multiple SQL Injection Vulnerabilities
BID:44299
Info
Symantec IM Manager Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 44299 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-0112 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 27 2010 12:00AM |
| Updated: | Oct 27 2010 05:58PM |
| Credit: | Andrea Micalizzi through TippingPoint�??s ZeroDay Initiative |
| Vulnerable: |
Symantec IM Manager 8.4.15 Symantec IM Manager 8.4.13 Symantec IM Manager 8.4.5 Symantec IM Manager 8.4 Symantec IM Manager 8.3 |
| Not Vulnerable: |
Symantec IM Manager 8.4.16 |
Discussion
Symantec IM Manager Multiple SQL Injection Vulnerabilities
Symantec IM Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Symantec IM Manager versions 8.4.15 and prior are vulnerable.
Symantec IM Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Symantec IM Manager versions 8.4.15 and prior are vulnerable.
Exploit / POC
Symantec IM Manager Multiple SQL Injection Vulnerabilities
Attackers can use readily available network utilities to exploit this issue.
Attackers can use readily available network utilities to exploit this issue.
Solution / Fix
Symantec IM Manager Multiple SQL Injection Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Symantec IM Manager Multiple SQL Injection Vulnerabilities
References:
References:
- Symantec Homepage (Symantec)
- Security Advisories Relating to Symantec Products - Symantec IM Manager Multiple (Symantec)
- ZDI-10-220 Symantec IM Manager Administrative Interface IMAdminScheduleReport.as (Zero Day Initiative)
- ZDI-10-221 Symantec IM Manager Administrative Interface IMAdminReportTrendFormRu (Zero Day Initiative)
- ZDI-10-222 Symantec IM Manager Administrative Interface rdpageimlogic.aspx SQL I (Zero Day Initiative)
- ZDI-10-223 Symantec IM Manager Administrative Interface LoggedInUsers.lgx Defini (Zero Day Initiative)
- ZDI-10-224 Symantec IM Manager Administrative Interface SummaryReportGroup.lgx D (Zero Day Initiative)
- ZDI-10-225 Symantec IM Manager Administrative Interface DetailReportGroup.lgx De (Zero Day Initiative)
- ZDI-10-226 Symantec IM Manager rdServer.dll sGetDefinition SQL Injection Vulnera (Zero Day Initiative)