BugTraq
CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4 Dec 01 2014 08:49AM
Stephan Rickauer swisscom com
#############################################################
#
# SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security
#
#############################################################
#
# CVE ID: CVE-2014-3809
# Product: 1830 Photonic Service Switch PSS-32/16/4
# Vendor: Alcatel-Lucent
# Subject: Reflected Cross-site Scripting - XSS
# Effect: Remotely exploitable
# Author: Stephan Rickauer (stephan.rickauer _at_ swisscom.com)
# Date: December 1st 2014
#
#############################################################

Introduction:
-------------
Swisscom CSIRT discovered a security flaw in the management interface
of the Alcatel Lucent 1830 Photonic Service Switch series.

Vulnerable:
-----------
All Switches of Release 6.0 or lower are vulnerable.

Patches:
--------
None.

Description:
------------
The management interface of the 1830 Photonic Switch series is vulnerable
to reflected cross-site scripting, since user input is not properly encoded
on output. Exploiting this vulnerability will lead to so-called cross-site
scripting (XSS) and allows the impersonation of logged-in admin users.
Additionally, the myurl-Parameter accepts non-local web addresses, which
can be abused to redirect victims to arbitrary web sites.

Attack vector:
--------------
https://xx.xx.xx.xx/menu/pop.html?myurl=);<script>alert('xss')</script>

Statement Vendor:
-----------------
"The vulnerability is assessed at no risk. We will evaluate if/when we
will add the best practice of validating all inputs in WebUI tasks, but
this is not considered high priority for the roadmap."

Milestones:
-----------
May 21st 2014 Vulnerability discovered
May 21st 2014 CVE requested
June 13th 2014 Vendor contact established and provided with technical details
June 16th 2014 Vendor acknowledged issue (Psirt.Security at alcatel-lucent.com)
Aug. 28th 2014 Vendor update requested
Okt. 1st 2014 Vendor update requested
Dec. 1st 2014 Vendor update requested
Dec. 1st 2014 Vendor assess XSS not to be an issue
Dec. 1st 2014 Public release of advisory
0? *?H?÷
 ?0?1 0 +0? *?H?÷
 ?î0?Y0?A &?ul?ÔïÌã¹a:0
 *?H?÷
0d1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Root CA 10
060223095312Z
160223095312Z0e1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Rubin CA 10?"0
 *?H?÷
?0?
?ÆY8Íg?q,Ðn{Ðö9¡JDÖR)F:vªmÏO?÷û&?c¯(}>RìD⸷qìs°ÞøýýÞË$}û?¿
ú?þ?ï?ÒßáLb?\¦<?³¼>L?GnÏv?;?µ,·£ð Mz`×uB ¤?5lê¬É?Q?<ØK=Rì/¥T\Oà 4Ç?ÔÈ!me?îC}¯ûÂ쥍½Ú|S¯ðAýzÑüÚ«??åñÚ%ûc
?ã7ÿ?skGò°íK?ÑzByLåo¹¼!Î2u{å(²ócÙ? õºÝn?å(<¨4ÉúRÕ?RnA?£?0?0@+40200+0?$http:/
/www.swissdigicert.ch/download0Uÿ0ÿ0U  0
0`?tS0CU<0:08 6 4?2http://www.swissdigicert.ch/download/sdcs-r
oot.crl0Uÿ0U-§£c>??G«H36?÷Ôé¬À0U#0?%/Þo
?:\,Ü+¡iµgÔ?Óý0
 *?H?÷
?µÚ|?±Ô?ohÚ¾\1DÑ¡JèÇHLAc)¯A?úÜ?Ge?¯8¤?×/$ëyNe­RÅô¤
ËÀ7©¸?~:_ûSÏ· VªÉ}ü?£ïÜRNÍÔ?n³#ô¥½vq¸£$ÿ¥ÓÇ?hwGUHµ3}^lÞ¡gJP¬4uÜcóSül§;A
ÚH?TµîM?x'!(H?7<êk_T%¼Ùªç/Ú½\?~)Á_éÜ7Ð1ù?îª}ñ?{Á0èG¹(y¤y]t
¦ó&&(õáöb>¡?õGnÞ©ØÚG×?º? >GSi"J#f§è8e¬ûªÿµxeR?mþÿxª?Y[??¿úÁK ?¨?´B#3D{?=$ ï8 -?]ÛÊðW?HÌEb)t
ÍDhh?ÙÆ?]ñEëÌÄSûº¸©zP?YÏXsúiçEbíý"³)Î pQ?Í^±Éºk¼ß0ñÏXQ]v\?:¿ÒjÄI¤
H^NÇ=-ÀTÞ?\±TÄ xIº·KQϐ?³GÆÆtR²ÒzßÞ-"O¨C¯ð|ý®ôöÝ«:?^k? ¤J;) ½¼??ÀÏ¡·fBîë¤Øe}?¿Ù&ûôÁv?ÉÆ24ïÞZ@M C???q½#Üò?2ë0?°0?? ??
sg{¬0
ª/Ð0
 *?H?÷
0e1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Rubin CA 10
140402104056Z
170402104056Z0£1
0 UBern1 0 UBE1
0 U SCIS1 0U
Swisscom IT Services AG1 0 UCH10UStephan Rickauer1,0* *?H?÷
 stephan.rickauer (at) swisscom (dot) com0 [email concealed]?"0
 *?H?÷
?0?
?·v¾ùæ{h<B¤!?ÿÍÁ@=Iò?3ª(î?Ý*±÷?d±úyÁà?åfn?Û¸«ÚVÜN²<nê:6kÐáú
ýô?mµÓWÍ'©Oµ<ôìA?`}õ^XjÛAU?ÐI±õEÐ?ê3ß³;BZ?4Í?I3ÀRO?Ý?¸?cÏóàYÁ8F±
t7S¸ÅQ?"??Ç?åËoÆ^lQæèM7ݳ#çzá???¬0?x]ÔêÕQIÎ>?RÁ¯Ù\7Ù?{²2fÔöÒçü?,W¢
µ«­|?§?zôß??bÂYõ´RàãíFRqèEÕE)Ì¡<üx£»m£?0?0v+j0h0
.+0?"http://ocsp.swissdigicert.ch/rubin06+0?*http://aia.
swissdigicert.ch/sdcs-rubin.crt0U#0?-§£c>??G«H36?÷Ôé¬À0HU A0?0=`?tS0301+%http://www.swissdigicert.ch/documents0¹
U±0®00 . ,?*http://crl.swissdigicert.ch/sdcs-rubin.crl0z x v?tldap:
//ldap.swissdigicert.ch/CN=Swisscom%20Rubin%20CA%201,dc=rubin,dc=swissdi
gicert,dc=ch?certificateRevocationList?0U%0++0
Uÿ°0(U!0stephan.rickauer (at) swisscom (dot) com0 [email concealed]Uó??l
þÍ??©Lþ®© ¢¢¼?0
 *?H?÷
?.ÓÓÝ_ÛÈH7|høï8§Î@Ëädçî%§@rrj±²?eXR×Ð+¡òÅ?gFó1F8%þ÷q¯¿¡¥
&¥©Ó?8­?»Ü½Z?0yÆh??>Trù*??¢ït
¤;3ɨN??ÀÙHøµLw?¨çu¶ì+< ä?b% ß? I* Ûp|öcèâÈÕÿjãS??}s?hÆª_ 1JOE?1?ôzèl¿ºîoóäOÏè/~¡ ú?EÚ!0XoO8Ö?vw£«ûäYÌ?!úÀvZ=,×?´X;?ÈW·S
iD÷ßZj;`?nBÒ?0?Ù0?Á \ ?\ çYAßWÌ?¨60
 *?H?÷
0d1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Root CA 10
050818120620Z
250818220620Z0d1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Root CA 10?"0
 *?H?÷
?0?
?й°¨ Ù»?!øÕ3??e u²=?`mFÈ?1oÃú?lVí<Å?WÃÍ«?I*K£mWÝñ+b(uE^ªÖ[ú %Ø¡ùÄ.æ?*gÌÐ)n<?48aI±?
Ö:q_MmÎ_¹©ä?jRúÊ?òÜ©ù?G?N)_´¦]{ ?þçÛÛ£ÿ¥Í5°ېoÆ~{Ñîzz§ª Wo¤mÅ;°¥Ùí2´^g?TÜs?åÓ|fPr]ÔXÁÙÏØ?o§I´6]ФÞ,¶u·(?Ö?¾(õ?ê[&ɽ°?sÚ®?
&ëhÁù9ÖgK
mOËÏ°äBq?SyçîáÛ n?w5\+S4?Ñlüògzõ­íÖ?«¡±KáÌ7_ýÍM®¸?Cù*XUCE¼?Ípü
ÉãfºN;Ëd{¹?è]3R?q.O?¢QÉãË¡n1d ÂÒ<õ6è×Ðx# ?É$*e)["÷!Î?^¤óÞKÓhFu\? n)kÄp?õ× /ÿFÒ+8Â/u=~Ú¥ï`?iBÓÌøcþC9?¦¶cA³s¼ÓúÊ}Gâ§ÕУ?
?bVn4ÛÙ¹0uãÒçÂ°@
¬Õqb?1¾ÝÆ#X1BC-tùÆ?¦?éþ¿?æCW$ºïF4ª×8í£?0?0Uÿ?0U
!00`?tS`?tS0Uÿ0ÿ0U#0?%/Þo?:\,Ü+¡iµ
gÔ?Óý0U%/Þo?:\,Ü+¡iµgÔ?Óý0
 *?H?÷
?5Ëì¦

ÍÀÛ«¨ò?? ß?/M|@V1zë¤`Ízó¾Ã'?>¤Ýï~t<?1ò{?1!´ðÐl?Ôé?²$VVÃ5½?[dáÇ?0ù2­?P,
çxÐ1±Z??uN\j*àRG?`æځ±û Zñ?Ò?º>ÐÖ£¾?ÕÛÀId».PKÒ$øÝVÐ8 ?p v?×ÝÞ?qÄ#ï?\£$M)@<jÄ©Ø·¦D¥
ôàw@p&üÚÙ6äyäµ?¼?e¾»?ÏÛÆ(9:ÎG[SZÅ?þ]©ÝïLÔÆ¥­æ?oÑo £ó)½ÇP¢°?©?
w?±À¥9.\|iâ,°ê7j¤áZáõPå?糧*?ç?Ûým^?¨~fukq꿱Ço ô?¤ì4Q[?&p¡wÕW5Û#Þ?
(?ý±oKÿ8-`N,?ëgµ­IîK¬¯û
Zf`p]ªÍxÔ$îÈA ???j?ü¹$ų?~¾®?+ë±ÀÚã` ^i¬?Va¾qþþÆ?Eéþ2 
¤?Uq¥?ºÊ?°²ÇüØTµ?bÎÏYû=Î*Ë5?]ÿT"[qRû·Éþ`?Adðª*ì¶BCÎ?fÈ??9T%Ó5??
Ð_ú0õ?lôSù:[Ñ1??0?0y0e1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Rubin CA 1??sg{¬0
ª/Ð0 + ?í0 *?H?÷
 1  *?H?÷
0 *?H?÷
 1
141201084939Z0# *?H?÷
 1?Y^?
t£/õÒf]ZQKãÔ0v *?H?÷
 1i0g0  `?He*0  `?He0  `?He0
*?H?÷
0  `?He0  `?He0  `?He0  `?He0? +?71{0y0e1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Rubin CA 1??sg{¬0
ª/Ð0? *?H?÷
  1{0y0e1 0 Uch10U
Swisscom1%0#U Digital Certificate Services10USwisscom Rubin CA 1??sg{¬0
ª/Ð0
 *?H?÷
??ýÙ ÷ãjÎÉ÷#ÒJ13,ü ¥î©ù?ò́×?õ½ þk¹ý,2¤íÈÒ0¿PX÷ݻѧû¼e2eÌ@ëà{Cýö9Sñ£ÿo?-NêÇ"?v<°ä?ÃÞ;GKiÿYSê?Ü?Ê
·­kc04Ä?ÓDN°×óÀ¼ø?³%?î«Á¸Þ5ß#ò?âºt@7[l{?ô$Ç=?)Ñýåh®î j`P×¢ïW9nNØñ¦È?2¨r?®?ÿ·=ï] ^Ên Xã}Õ®,°e?'a?¯ ܶÇkà{Ín~2}ZÒçÀ?"²å>{¼Ù?u_ ^q4c

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus