← Advisories

IBM System Storage DS Storage Manager Profiler Multiple Vulnerabilities

Medium
Advisory ID
ZSL-2012-5094
Release Date
20 June 2012
Vendor
IBM Corporation - http://www.ibm.com
Affected Version
4.8.6
Tested On
Apache-Coyote/1.1, MySQL
Summary

Through its extraordinary flexibility, reliability, and performance, the IBM® System Storage® series is designed to manage a broad scope of storage workloads that exist in today’s complex data center and do it effectively and efficiently. This flagship IBM disk system can bring simplicity to your storage environment by supporting a mix of random and sequential I/O workloads for a mix of interactive and batch applications, regardless of whether they are running on one of today’s popular distributed server platforms or on the mainframe.

Description

IBM System Storage DS Storage Manager Profiler suffers from an SQL Injection and a Cross-Site Scripting (XSS) vulnerability. Input passed via the GET parameter 'selectedModuleOnly' in 'ModuleServlet.do' script is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The GET parameter 'updateRegn' in the 'SoftwareRegistration.do' script is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
Disclosure Timeline
03.03.2012Vulnerabilities discovered.
19.04.2012Reported vulnerability report to vendor.
19.04.2012Vendor acknowledges receipt of the vulnerability report.
25.04.2012Asked vendor for confirmation.
26.04.2012Vendor confirms the issues, working on mitigation plan.
01.05.2012Vendor promises that the updated package will be available in June timeframe.
05.06.2012Asked vendor for status update.
07.06.2012Vendor replies.
15.06.2012Vendor releases fix.
20.06.2012Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
20.06.2012Initial release
21.06.2012Added reference [7], [8], [9], [10], [11] and [12]
22.06.2012Added reference [13]
24.06.2012Added reference [14] and [15]