-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0017
        Vulnerabilities have been identified in Hitachi Cosminexus,
                          JP1 and JP1/IT products
                              3 February 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              JP1/IT Desktop Management - Manager
                      JP1/IT Resource Management - Manager
                      JP1/IT Service Level Management - Manager
                      uCosminexus Stream Data Platform - Application Framework
                      uCosminexus EUR Print Manager - Report Server
                      HiRDB RealTime Monitor
Operating System:     Windows
                      Linux variants
                      HP-UX
                      AIX
Impact/Access:        Cross-site Scripting -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
Member content until: Sunday, March  4 2012

OVERVIEW

        A cross site scripting vulnerability has been identified in Hitachi 
        Cosminexus, JP1 and JP1/IT HiRDB RealTime Monitor products.


IMPACT

        The vendor has provided the following description of the vulnerability:
        
        "A cross-site scripting vulnerability was found in JP1/IT Desktop 
        Management - Manager. Remote users can exploit this vulnerability to 
        execute malicious scripts." [1]
        
        "A cross-site scripting vulnerability was found in JP1 Products.
        Remote users can exploit this vulnerability to execute malicious 
        scripts." [2]
        
        "A cross-site scripting vulnerability was found in uCosminexus 
        Products. Remote users can exploit this vulnerability to execute 
        malicious scripts." [3]


MITIGATION

        The vendor recommends upgrading to the latest versions of these 
        products. [1][2][3]


REFERENCES

        [1] Cross-site Scripting Vulnerability in JP1/IT Desktop Management -
            Manager
            http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-004/index.html

        [2] Cross-site Scripting Vulnerability in JP1 Products
            http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-005/index.html

        [3] Cross-site Scripting Vulnerability in uCosminexus Products
            http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-006/index.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTytvTu4yVqjM2NGpAQILyBAAq2EtsV7YNgiNpTE1gBbWnWD14PuWPFvd
qgvjuIGYgzc2wpWKp8xowXU5tjqFilits4X74DkRL1Ad+k0/9eomz/WEjvsu2pEH
opx5a6bARRBmJiXN8zqB2BzXgpo/nx6SfmtxM89GkLZ8bmR/Qo5qfLLyxPQjlSFr
Tabf+9zKhk2gtcmGodYBmYjJBPtU7J0xVhqZBItQa+aeLlK4890CFxmfYdG2NVkm
wS5KNABIeRPijUEkA/eAvMYq12zCc1ljFfdizLskOV5/TaXfzkFnZue0axLbUCG5
+2k2l9VDKkhIKkiKHF6UqdVuK1DIoC17s9F6IiY0ZW5PfHuToAAbuySrdvHpyAzn
Wn6jt7y/TkyIccxa46OZnpVqe+22inpcsQD8HQN0ScD/y9h1UHt7xSgPhltlk1Uk
9nPKGynZoa+/VjbwDw6PON7maPVEQ0iMJ5D/FqoUGurbT+GltkLuGo+tPF+dIY6o
x29ToMXilLAruVPcOSTfPF/lvimmlp7Y8J1do4SJQvghaUMiQFjYUhubK4dPKfO1
yzjIk1xRGjMa4P7NXr/1+tyqntFFaYjSmshOH1MgFweLSppc1+uuLF+F0oZiYj86
z+krc8VL77T2r+TDzcfnkj/F3YJWbjaVJ8GtLl9LudaSFC4uPu8Gu/d9kbxnrqM2
EeQu/caJkJQ=
=HIPg
-----END PGP SIGNATURE-----