Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Rational ClearQuest Input Validation Holes Permit Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1019685
|
|
SecurityTracker URL: http://securitytracker.com/id?1019685
|
|
CVE Reference: CVE-2007-4592
(Links to External Site)
|
Date: Mar 21 2008
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 7.0.1.1 and prior versions
|
Description: A vulnerability was reported in Rational ClearQuest. A remote user can conduct cross-site scripting attacks.
Several scripts do not properly filter HTML code from user-supplied input before displaying the input. A remote user can create
a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's
browser. The code will originate from the site running the Rational ClearQuest software and will run in the security context of
that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated
with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as
the target user.
The 'contextid', 'schema', 'userNameVal', and 'username' parameters are affected.
sasquatch of SecureState
reported this vulnerability.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
Rational ClearQuest software, access data recently submitted by the target user via web form to the site, or take actions on the
site acting as the target user.
|
Solution: The vendor has issued test fixes.
|
Vendor URL: www.ibm.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (Any)
|
Reported By: swhite@securestate.com
|
Message History:
None.
|
Source Message Contents
|
Date: 19 Mar 2008 18:39:11 -0000
From: swhite@securestate.com
Subject: IBM Rational ClearQuest Web Multiple XSS Vulnerabilities
|
IBM Rational ClearQuest Web Multiple XSS
CVE-2007-4592
Discovered on 07-24-07 by sasquatch of SecureState - www.securestate.com
Multiple cross site scripting vulnerabilities exist within IBM's Rational ClearQuest Web interface.
VULNERABLE VARIABLES:
=====================
contextid (query string parameter)
schema (query string parameter)
userNameVal ("User Name" text box)
POC URL: http://www.website.com/cqweb/login?/cqweb/main?command=GenerateMainFrame&service=CQ&
schema=SCHEMAHERE"; alert('XSS');//&contextid=DATABASECONTEXTHERE";
alert('XSS');//
VULNERABLE VARIABLE:
====================
username (query string parameter)
POC URL: http://www.website.com/cqweb/login?targetUrl=/cqweb/main?command=GenerateMainFrame&ratl_
userdb=DBHERE,&test=&clientServerAddress=http://www.website.com/cqweb/login&username=test<
/script><script>alert('xss')</script>&password=test&schema=S
CHEMAHERE&userDb=DBHERE
VENDOR RESPONSE:
================
Test fixes are now available from IBM Rational Support for versions 2003.06.16 Patch 2007C, 7.0.0.1_i
Fix04, and 7.0.1.0_iFix01.
These are the latest available patch releases before December 19, 2007.
Test fixes will be made available from IBM Rational Support some time in January 2008 for versions 20
03.06.16 Patch 2007D, 7.0.0.2,
and 7.0.1.1.
These patch releases became available on December 19, 2007 but there was no time to fix this vulnerab
ility in these releases.
For this reason, we will provide test fixes that do fix it some time in the middle or latter half of
January 2008.
The following patch releases will fix this vulnerability: 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, an
d 7.0.1.1_iFix01.
These patch releases were made available on March 4th, 2008.
Test fixes are only available by calling IBM Rational Support, which then provides them to customers.
Patch releases are available via download. Please contact IBM Rational Support for detailed informat
ion.
|
|
Go to the Top of This SecurityTracker Archive Page
|
