IBM_Maximo_debug_jsp_Cross_Site_Scripting

Overview

» IDS/IPS Signatures

Security Sites

iPolicy Networks Security Advisory

IBM Maximo debug.jsp Cross Site Scripting Vulnerabilities


Date Discovered:	7/15/2008
Severity:	High
Applications Affected:	IBM Maximo 4.1 IBM Maximo 5.2

Synopsis

Cross-Site Scripting vulnerability has been discovered in IBM Maximo 4.1 and IBM Maximo 5.2. A remote user can execute arbitrary code to the target user's system. Remote attackers can successfully exploit this vulnerability by sending malformed HTML link to the victim, and enticing to victim to open this HTML file or click on the malformed link.

Recommended Actions

Allows only trusted users.

Threat Analysis

The IBM Maximo provides a wider range of services while supporting a wider range of requirements, including integration with operational and enterprise applications. The IBM Maximo is a integrated and comprehensive product of IBM. Maximo Asset Management also provides comprehensive asset lifecycle and maintenance management for all asset types on a single interface platform. Maximo Asset Management centralized the control over all the products in any organization.

Cross-Site Scripting vulnerability has been discovered in IBM Maximo A remote attacker can inject arbitrary web script via the (1) Accept, (2) Accept-Language, (3) UA-CPU, (4) Accept-Encoding, (5) User-Agent, or (6) Cookie HTTP headers parameter in the jsp/common/system/debug.jsp. To exploit this issue an attacker sends malformed HTML file or link to victim and enticing him to open that malicious file or click on the link which results arbitrary code execution on the victim machine. After successful exploitation a remote attacker can steal the cookie-based authentication credentials from the victim machine and can make further attack.

References

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3161
http://www.securityfocus.com/bid/30180/info
http://www.security-database.com/detail.php?alert=CVE-2008-3161
http://www-306.ibm.com/software/tivoli/sw-atoz/indexM.html

Write-up by: Gaurav Bajpai

Security Sites

“iPolicy is one of the most visionary firewall vendors in the firewall Magic Quadrant. Its architecture of a central session processing engine and multiple content blades that are able to block based on signatures, rules and so on is the closest to the network security ideal.”

Greg Young, John Pescatore
Magic Quadrant for Network Firewalls, 2H04, Gartner

| | | | | | | | |