Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1604
Security Bulletin: Security Network Protection is affected by a cross-site
scripting vulnerability (CVE-2013-5442)
12 November 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Security Network Protection
Publisher: IBM
Operating System: Network Appliance
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2013-5442
Original Bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg21655377
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Bulletin: Security Network Protection is affected by a cross-site
scripting vulnerability (CVE-2013-5442)
Flash (Alert)
Document information
IBM Security Network Protection
General Information
Software version:
5.1, 5.1.1
Operating system(s):
Firmware
Reference #:
1655377
Modified date:
2013-11-08
Abstract
IBM Security Network Protection is affected by a cross-site scripting
vulnerability that could be used to impersonate a legitimate user, allowing
the impersonator to alter user records, and to perform transactions as that
user.
Content
Vulnerability Details:
The IBM Security Network Protection Local Management Interface is affected.
The vulnerability identified below is remotely exploitable, some specialized
knowledge may be required, and authentication is not required.
CVE ID: CVE-2013-5442
DESCRIPTION:
The IBM Security Network Protection Local Management Interface (LMI) allows
the injection of a script which will be executed when the page loads in the
users browser. This exploit could impact the integrity of the data, but the
confidentiality of information and the availability of the system are not
compromised.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87818 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED PRODUCTS AND VERSIONS:
Products: XGS 5100
Firmware versions: 5.1, 5.1.1
REMEDIATION:
Upgrade the IBM Threat firmware to the version listed below:
Fixpack 5.1.0.6 for IBM Security Network Protection version 5.1
Fixpack 5.1.1.1 for IBM Security Network Protection version 5.1.1
Contact IBM Security Systems Support
(http://www-947.ibm.com/support/entry/portal/support) to upgrade to the above
required Firmware.
Workaround(s):
None
Mitigation(s):
None
REFERENCES:
Complete CVSS Guide
On-line Calculator V2
CVE-2013-5442
http://xforce.iss.net/xforce/xfdb/87818
RELATED INFORMATION:
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
CHANGE HISTORY:
8 November 2013: Original copy published
ACKNOWLEDGEMENT
None
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
References section of this Flash.
Note: According to the Forum of Incident Response and Security Teams (FIRST),
the Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUoGyLRLndAQH1ShLAQKdjw//VQ3qLYUa6ZhYHvrTr2E++booNTje8Hck
g3yy2OJMhmfcUQMNJS8lJPOqEkaokaAqgvGZRQ8Z7SKhFMewARAmJ4Wgvc1z8HVN
vEQsa3M2QBsMEt8G+sgKMsPcYz64j8UZ8vBU3uxmdFingP8x10Zuss2HQk5eGWHh
E50FZyZNORj6Yw/1nwdgEbbSq+XbNJTLA8AWG7nbNrj6nr6n2AcFU6UpcjQ8uDws
4K7foJLaxmSrNo2axEM6/xz96/pqsWNWg0Rg84863dAgnCZW3NY5in3++0VNxWpX
9O2GA/TE737LAMovuASZjsGXDiVR5xfi1VB8doWUr1drPvIKDPpw7snDpc0wuHM8
I4n939lHgnS28EB9sE/s3/dEh7g4IcA/VXtjFIdRTOJJnKMzX5AbKLYAB8ygh7AJ
3+sfYir7DUh4wSEee0jIX4WRXr1pFngewx4qJ1Gt30y34r8Ru6XmVQ8JqQg3oJ8n
c0JCnCZO5M10+EMMfak1FqLGdt4G/va0gc7tJxyT4TXDcdi1qZ6m6rFoUSMLAWWS
Ss7MVPClL7HLFo6hcgnRA0L63hgwPIotwfyQyFk2V4sT3W3H4fd+Qg9kx1C+duWu
3x5RSK6/w1Pt6G0HQW5DYPJ6g/45CpGswl5p3kByCWN9dFoXa9WXLiOGrY0DbVsh
RglE2yld6tE=
=WkNP
-----END PGP SIGNATURE-----