Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1659
ESA-2013-078: EMC Document Sciences xPression Multiple Vulnerabilities
20 November 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: EMC Document Sciences xPression
Publisher: EMC
Operating System: Windows Server 2008
AIX
Solaris
Red Hat
SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Cross-site Request Forgery -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-6177 CVE-2013-6176 CVE-2013-6175
CVE-2013-6174 CVE-2013-6173
- --------------------------BEGIN INCLUDED TEXT--------------------
ESA-2013-078: EMC Document Sciences xPression Multiple Vulnerabilities
EMC Identifier: ESA-2013-078
CVE Identifier: CVE-2013-6173, CVE-2013-6174, CVE-2013-6175, CVE-2013-6176,
CVE-2013-6177
Severity Rating: CVSS v2 Base Score: See below for individuals scores
Affected products:
Version 4.1 SP1, 4.2 and 4.5 are affected for following products:
EMC Document Sciences xPression Enterprise Edition Publish Engine
EMC Document Sciences xPression Enterprise Edition Compuset Engine
EMC Document Sciences xPression Documentum Edition
Summary:
EMC Document Sciences xPression is vulnerable to multiple vulnerabilities that
could be exploited by malicious users.
Details:
EMC Document Sciences xPression may be susceptible to the following
vulnerabilities:
1. Cross-Site Request Forgery Vulnerability (CVE-2013-6173)
CVSSv2 Base score: 8.3 (AV:N/AC:M/Au:N/C:P/I:C/A:P)
The attacker can conduct CSRF attacks to perform unauthorized administrative
actions in xAdmin and xDashboard by getting a user with active administrative
session to click on specially-crafted links that are embedded within an email,
web page or other source by a malicious attacker.
This vulnerability is not applicable to EMC Document Sciences xPression 4.1.x
versions.
2. Open Redirect Vulnerability (CVE-2013-6174)
CVSSv2 Base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Some parameters in xAdmin may allow remote attackers to redirect users to
arbitrary web sites and conduct phishing attacks.
3. Multiple Cross Site Scripting Vulnerabilities (CVE-2013-6175)
CVSSv2 Base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Several xAdmin and xDashboard forms are vulnerable to cross-site scripting
vulnerabilities. The vulnerabilities could be exploited by getting an
authenticated user to click on specially-crafted links that a malicious
attacker can embed within an email, web page or other source. This may lead to
execution of malicious html requests or scripts in the context of the
authenticated user.
4. SQL Injection Vulnerability (CVE-2013-6176)
CVSSv2 Base score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
An unauthorized xAdmin or xDashboard user can conduct SQL injection attacks to
read and modify data in the SQL database.
5. Path Traversal Vulnerability (CVE-2013-6177)
CVSSv2 Base score: 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N)
An unauthorized xDashboard user can exploit this vulnerability to read
arbitrary files from the affected file system.
Resolution:
The following products contain resolution to these issues:
EMC Document Sciences xPression 4.1 SP1 Patch 47 and later
EMC Document Sciences xPression 4.2 Patch 26 and later
EMC Document Sciences xPression 4.5 Patch 05 and later
EMC strongly recommends all customers upgrade at the earliest opportunity.
Link to remedies:
The software patches can be obtained by submitting an upgrade request form from
EMC Powerlink.
Credits:
EMC would like thank the following individuals from Verizon Enterprise
Solutions - Threat and Vulnerability Management (GCIS):
Discovery: Sertan Kolat and Omer Coskun
Coordination: Thierry Zoller
Read and use the information in this EMC Security Advisory to assist in
avoiding any situation that might arise from the problems described herein. If
you have any questions regarding this product alert, contact EMC Software
Technical Support at 1-877-534-2867.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution
emc218831. EMC recommends all customers take into account both the base score
and any relevant temporal and environmental scores which may impact the
potential severity associated with particular security vulnerability.
EMC Corporation distributes EMC Security Advisories, in order to bring to the
attention of users of the affected EMC products, important security
information. EMC recommends that all users determine the applicability of this
information to their individual situations and take appropriate action. The
information set forth herein is provided "as is" without warranty of any kind.
EMC disclaims all warranties, either express or implied, including the
warranties of merchantability, fitness for a particular purpose, title and
non-infringement. In no event, shall EMC or its suppliers, be liable for any
damages whatsoever including direct, indirect, incidental, consequential, loss
of business profits or special damages, even if EMC or its suppliers have been
advised of the possibility of such damages. Some states do not allow the
exclusion or limitation of liability for consequential or incidental damages,
so the foregoing limitation may not apply.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUowchhLndAQH1ShLAQK90BAAoG95ScLYDuqEn0hL6QUJ6/LSOKEj/HgK
XtXGvbSL6SoKLzX1GdVFy8i51S0I0a3RbL5NrrMNhNSLLrLFGeNWooBtHfg61wKE
zuae7RREjTZjptzpaXFHPeT0bKP3ppNnKZjErZAzCWI6hN9vCJeP5erbCxzvmSLJ
V8r+z8JTnHCFwMY/8aqyzjxnI9Fpuc1wTuMfiTDtcka1qxbeRN4oMROlwMiexQ4Q
9ZYg75QKRA6cWNXT9pxT4fr2M2U32p5+MtrS6DjxYcZgwDOv18Wl2eJGlXmNk01h
m66/ssVwpPQ9X+zPe5WPCDS1vzbOO0/cdNDriRdkU5HZgq9fzevsxWGql9rLrIHg
1BKjc245/NFZ0v6gts4w7g3jaCD2cMRHQWi+jG9RXYDssiHrJugUqnahiz4Sav/J
KFMlre6L6zfgVWitdDU/Y+Yic4vpKdTVc+NmRj/df7+XXLMMU1rwJIo02iqkFFrA
pd3K216NBvzx4v0OdM9azVEOribyeMm2PoLpZHfycQUleqK5U/So+Q5cQWc+U0NV
5dd15aNjytdZCFS34pApQ1BH3jkNn9n/QZ+EKpOaXcGiNYRQCD37WJkKgF6SCgyH
wxpH8bZj8/aeqS123XqZH7vIbf0oX+++xp5vJnu/EYM7wDRSIORiNEQEA9vF6cPz
T0MBuCY1N8g=
=zPPZ
-----END PGP SIGNATURE-----