AusCERT - ESB-2013.0616 - [Win][Linux][Solaris][AIX] IBM Sametime and Classic Meeting Server: Cross-site scripting

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2013.0616 - [Win][Linux][Solaris][AIX] IBM Sametime and Classic Meeting Server: Cross-site scripting - Remote/unauthenticated
Date: 02 May 2013

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2013.0616
           Security Bulletin: Vulnerability in Classic Sametime
                      Meetings Server (CVE-2013-0535)
                                2 May 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Sametime
                   Classic Meeting Server
Publisher:         IBM
Operating System:  AIX
                   IBM i
                   Linux variants
                   Solaris
                   Windows
Impact/Access:     Cross-site Scripting -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2013-0535  

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21635185
   http://www-01.ibm.com/support/docview.wss?uid=swg21635545

Comment: This bulletin contains two (2) IBM security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Vulnerability in Classic Sametime Meetings Server 
(CVE-2013-0535)

Document information

IBM Sametime

Classic Meeting Server

Software version:
7.5.1.2, 8.0.1, 8.0.2, 8.5, 8.5.1.2, 8.5.2.1

Operating system(s):
AIX, IBM i, Linux, Solaris, Windows

Reference #:
1635185

Modified date:
2013-04-29

Abstract

The Web Application of the Classic Sametime Meetings server can be exploited 
via potential cross-site scripting (XSS) vulnerabilities. A fix is provided.

Content

VULNERABILITY DETAILS:

DESCRIPTION:

A fix is available for a potential cross-site scripting (XSS) security 
vulnerability that has been identified in connection with the IBM Classic 
Sametime Meetings Server.

The issue can be fixed by installing the provided fix (see below under 
REMEDIATION heading)

CVE-ID: CVE-2013-0535
CVSS:

CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/82657 for the 
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS:

IBM Classic Sametime Meetings server 8.5.2.1 and prior releases

REMEDIATION

The recommended solution is to apply the fixes that are provided by IBM for 
the affected IBM Classic Sametime Meetings server. The needed fix is for the 
Web Application part of the server.

Refer to the following technote for instructions on how to download the 
relevant fixes:

"Fix available for potential cross-site scripting (XSS) security 
vulnerabilities in Classic Sametime Meetings Server Web Application."

WORKAROUND:

None known; apply fixes. 

MITIGATION:

None known; apply fixes.
REFERENCES:

Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html 
On-line Calculator V2: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 
X-Force Vulnerability Database: http://xforce.iss.net/xforce/xfdb/82657 
CVE-2013-0535: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0535 

RELATED INFORMATION:

IBM Secure Engineering Web Portal 

IBM Product Security Incident Response Blog 

ACKNOWLEDGEMENT: 

The vulnerability was reported to IBM by Christian Frei from usd GA. 


CHANGE HISTORY: 

<April 30 2013>: Original Copy Published.
*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact 
of this vulnerability in their environments by accessing the links in the 
Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), 
the Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- ------------------------------------------------------------------------------

Fix available for potential cross-site scripting (XSS) security 
vulnerabilities in Classic Sametime Meetings Web Application

Document information

IBM Sametime

Classic Meeting Server

Software version:
7.5.1.2, 8.0.1, 8.0.2, 8.5, 8.5.1.2, 8.5.2.1

Operating system(s):
AIX, IBM i, Linux, Solaris, Windows

Reference #:
1635545

Modified date:
2013-04-30

Abstract

A fix is available for a potential cross-site scripting (XSS) security 
vulnerability that has been identified in connection with the IBM Classic 
Sametime Meetings Web Application.

Content

A fix is available that removes the vulnerability in the Classic Sametime 
Meetings server. 

Please see the following security bulletin:

"Security Bulletin: Vulnerability in Classic Sametime Meetings Server 
(CVE-2013-0535)"

Sections below:
- - Affected products
- - Fix download links
- - Installation instructions for each version

Affected products


This potential vulnerability affects the following servers when using the 
Classic Sametime Meetings server web application to manage and join meetings: 
- - IBM Classic Sametime Meetings server 8.5.2.1 and prior releases

Fix download links


The fix for this security vulnerability is posted to IBM Fix Central. 
Refer to the table below for direct links to the fix by version. 


Classic Sametime Meetings 	Fix delivery vehicle
server version	
8.5.2.1				fix pack: 8520-ST-STConf--FP-RPOH-96GPGP
8.5.1.2				fix pack: 8510-ST-STConf--FP-RPOH-96GPDW
8.5				fix pack: 8500-ST-STConf--FP-RPOH-96GPAK
8.0.2				fix pack: 8020-ST-STConf--FP-RPOH-96GP75
8.0.1				fix pack: 8010-ST-STConf--FP-RPOH-96GP3Z
7.5.1.2				fix pack: 7511-ST-STConf--FP-RPOH-96GNYC


Installation Instructions 


Follow the specific installation instructions below for your particular 
version of Classic Sametime Meetings server.

Installation Instructions Version 8.5.2.1 

1. Bring down the Domino and Sametime server. 

2. Unzip the DateFormatFix.zip file into the server directory: 
.../Lotus/Domino/java 
You should end up with this file/path being extracted:

.../Lotus/Domino/java/com/lotus/sametime/meetingcenter/
NotesLocalizedString.class 
Note: There is more than one "java" directory on the server; make sure you 
are unzipping the file under the ../Lotus/Domino directory.

3. Backup stconf852.ntf in a directory not under your Domino directory. 

4. Copy the new stconf852.ntf to your Domino data directory. 

5. Replace the design of stconf.nsf with the new stconf852.ntf. 

6. Bring up Domino and Sametime. 

Installation Instructions Version 8.5.1.2 

1. Stop the server and backup stconf851.ntf. 

2. Replace the stconf851.ntf template on the server. 

3. Replace the design of stconf.nsf with the new template. 

4. Start the server.


Installation Instructions Version 8.5 

1. Stop the server and backup stconf85.ntf. 

2. Replace the stconf85.ntf template on the server. 

3. Replace the design of stconf.nsf with the new template. 

4. Start the server. 

Installation Instructions Version 8.0.2 

1. Bring down the Domino and Sametime server. 
Edit the notes.ini file to not have the STADDIN in this statement, if this is 
how the Sametime server is launched:

ServerTasks=Update,Replica,Router,AMgr,AdminP,CalConn,Sched,HTTP,LDAP,RnRMgr,staddin

Unzip the hotfix files into a temporary directory. You will have the following
files: 
stconf802.ntf 
stsrc.nsf 
webminilogin.js 
DateFormatFix.zip

2. Backup the original stconf802.ntf, stsrc.nsf, and webminilogin.js 
(webminilogin.js is located in \\Lotus\Domino\data\domino\html\sametime\) 

3. Replace with the new stconf802.ntf, stsrc.nsf, and webminilogin.js. 

4. Bring up Domino only! 

5. Replace the design of stconf.nsf with the new stconf802.ntf. 

6. Unzip the DateFormatFix.zip file into the server directory: 
.../Lotus/Domino/java 

7. Copy the directory on the server:

.../Lotus/Domino/data/domino/html/sametime/stmtghelp/en 

into a new directory: 
.../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_GB
and
../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_AU

NOTE: The end result will have 3 directories total with the same content but 
different names as follow: 
Original directory: .../Lotus/Domino/data/domino/html/sametime/stmtghelp/en 
New directory 1: .../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_GB 
New directory 2: .../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_AU 

8. Open up a Notes client and edit stconfig.nsf on the server; open the 
MeetingServices document; edit the field " Conference Started Event Field 
Names" and add the entry " STSignerAccess" to the end of the list. 

EXAMPLE: 

Meeting Scheduler Settings: 
Refresh Interval (millisec): 5000 
Conference Started Event Field Names: handle; state; StartDateTime; 
EndDateTime; Subject; STMeetingID; STActivityIDs; STMediaType; STAudioID; 
STIsBroadcast; InvitedServers; CalendarDateTime; CHAIR; moderator_cn; 
password; STIsEncrypted; STEndMeetingNow; STIsInvited; STConnectionProfile; 
STHasWhiteboardContent; STIsUnlisted; STIsModerated; options; 
STMeetingCenterVersion; STStartupMode; ConferenceReaders; InviteeList; 
STTopProviderAddress; STPanel; STCreator; STRecord; STRecordFile; 
STMaterialsNamespace; UnInvitedServers; STAudioBridgeConferenceID; 
STAudioBridgeClientID; STAudioBridgePasscode; STAudioBridgeClientPassword; 
STOrganization; STRecordingID; STAudioBridgeConferenceDocument; Body; 
STSignerAccess 
Places Field Names: T120ConferenceHandle; STIsEncrypted; STMediaType; 
STOrganization 

9. Save stconfig.nsf changes. 

10. Bring down Domino. 

11. Bring up Domino and Sametime. 


Installation Instructions Version 8.0.1 

1. Stop the Sametime server. 

2. Backup stconf801.ntf, webminilogin.js, and stsrc.nsf. 

3. Replace the design of stconf.nsf with the new stconf801.ntf. 

4. Copy stsrc.nsf to the Domino/Data directory. 

5. Copy over webminilogin.js in \\Lotus\Domino\data\domino\html\sametime\ 

6. Unzip the DateFormatFix.zip file into the server directory: 
.../Lotus/Domino/java 

7. Copy the directory on the server: 
.../Lotus/Domino/data/domino/html/sametime/stmtghelp/en
into a new directory:
.
../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_GB
and
../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_AU
NOTE: The end result will have 3 directories total with the same content but 
different names as follow:
Original directory: .../Lotus/Domino/data/domino/html/sametime/stmtghelp/en 
New directory 1: .../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_GB 
New directory 2: .../Lotus/Domino/data/domino/html/sametime/stmtghelp/en_AU 

8. Open up a Notes client and edit stconfig.nsf on the server; open the 
MeetingServices document; edit the field " Conference Start Field Names" 
and add the entry "STSignerAccess" to the end of the list. 

9. Save stconfig.nsf changes. 

10. Start the Sametime server. 

Installation Instructions Version 7.5.1.2 

1. Stop the Sametime server. 

2. Backup stconf751.ntf and stsrc.nsf. 

3. Copy the attached stconf751.ntf and stsrc.nsf to the data directory. 

4. Replace the design of stconf.nsf with the new template. 

5. Start the Sametime server.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUYH0De4yVqjM2NGpAQI0SQ/7BSiffZzt7+xBzpphwv6A34dMdDQ3u7p0
6cMnANG0BxOjqgNXqYtPkiv+Wtt992J5NG+tXke7kOXll0saX02NAGPgRuX/uU7e
JrNyf4lDCLPzMHxziNxUycKcMHwlG2xmKRB7pxNw69MdL3ZGAXJ6XYWRH9ipIS9o
XeNSN6EnY1sIt7nsRnb86uTrBIlsrWg4d+fODfKGAcLG5l9WpO+QljtVSAKaD2ux
Sgo+8TerJgUZnIVFTdRgJq27v8R0BT2xjUFmJNpEv+VKJaKs4ZPyZVdSuQqNzXP+
ze229Fmuq8e55Rs39UcZ6Z0+9kLahqkM0uDEWJo2DVesMbdHHLdevMsMh0G9S08v
YY9HPqMNH+yb5gGsC0piTejpwNyMp2FQ+tqBhBYs/kB4IHq0u/3S8BbApD56Gy2q
9yi/BXQ1VjAiM4/iAE/lCS4EfGIj6kp4xpW4s/D/oTsovl/gFYOAOfqET6afY4lO
65ckteAe0rAmq7tgM4hKUZj6Tw49nFEAPngB5bPnluGd+oevemZ5Tv4t5rSJGXDt
q5jstGEWIJ+3xGLXaHIkHX3K4mUH+Pk5C3zefvZhvsDLnX8vcQLqoT72MpVBAiaP
Mdjm+UFMM7AxVhU03or2d1WBBct1VLe93tTNACheYoz8O1Bkd77dZem4qh6mXAYl
dHmkv+EUgOc=
=R2kn
-----END PGP SIGNATURE-----