Tembria Server Monitor Cross Site Scripting Vulnerabilities and Password Encryption Weakness
BID:46384
Info
Tembria Server Monitor Cross Site Scripting Vulnerabilities and Password Encryption Weakness
| Bugtraq ID: | 46384 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-3685 CVE-2011-3684 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 14 2011 12:00AM |
| Updated: | Sep 29 2011 06:10PM |
| Credit: | Rob Kraus, Jose Hernandez, and Solutionary Engineering Research Team (SERT) |
| Vulnerable: |
Tembria Tembria Server Monitor 6.0.4 |
| Not Vulnerable: |
Tembria Tembria Server Monitor 6.0.5 |
Discussion
Tembria Server Monitor Cross Site Scripting Vulnerabilities and Password Encryption Weakness
Tembria Server Monitor is prone to cross-site scripting vulnerabilities and a password-encryption weakness.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.
Tembria Server Monitor 6.0.4 is vulnerable; prior versions may also be affected.
Tembria Server Monitor is prone to cross-site scripting vulnerabilities and a password-encryption weakness.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.
Tembria Server Monitor 6.0.4 is vulnerable; prior versions may also be affected.
Exploit / POC
Tembria Server Monitor Cross Site Scripting Vulnerabilities and Password Encryption Weakness
To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit the insufficient password encryption weakness, an attacker must obtain local interactive access to the affected computer.
To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit the insufficient password encryption weakness, an attacker must obtain local interactive access to the affected computer.
Solution / Fix
Tembria Server Monitor Cross Site Scripting Vulnerabilities and Password Encryption Weakness
Solution:
The vendor has released an update. Please see the references for details.
Solution:
The vendor has released an update. Please see the references for details.
References
Tembria Server Monitor Cross Site Scripting Vulnerabilities and Password Encryption Weakness
References:
References: