SafeNet Sentinel HASP and 7T IGSS Unspecified HTML Injection Vulnerability

Bugtraq ID:	51028
Class:	Input Validation Error
CVE:	CVE-2011-3339
Remote:	Yes
Local:	No
Published:	Dec 12 2011 12:00AM
Updated:	Dec 12 2011 12:00AM
Credit:	ICS-CERT
Vulnerable:	Safenet-Inc Sentinel HASP SDK 5.10 Safenet-Inc Sentinel HASP Run-time 5.95 7-Technologies Interactive Graphical SCADA System 7
Not Vulnerable:	Safenet-Inc Sentinel HASP SDK 5.11 Safenet-Inc Sentinel HASP Run-time 6.21

SafeNet Sentinel HASP and 7T IGSS Unspecified HTML Injection Vulnerability

SafeNet Sentinel HASP and 7T IGSS are prone to an HTML-injection vulnerability because they fail to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

The following applications are vulnerable:

Sentinel HASP SDK prior to 5.11
Sentinel HASP Run-time prior to 6.x
7 Technologies (7T) IGSS 7

SafeNet Sentinel HASP and 7T IGSS Unspecified HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

SafeNet Sentinel HASP and 7T IGSS Unspecified HTML Injection Vulnerability

Solution:
Updates are available; please see the references for more information.

SafeNet Sentinel HASP and 7T IGSS Unspecified HTML Injection Vulnerability

References:

• 7 Technologies Homepage (7-Technologies)
  
• ICSA-11-314-01?SAFENET SENTINEL AND 7T IGSS INPUT SANITIZATION VULNERABILITY (ICS-CERT)
  
• Security Vulnerability in Sentinel HASP® Run-time Environment v.5.95 and Earlier (SafeNet)
  
• Sentinel HASP Homepage (SafeNet)