=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN016
_____________________________________________________________________

DATE                : 10/01/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) :Systems running
                Dell OpenManage Server Administrator version 7.1.0.1.

======================================================================
http://www.kb.cert.org/vuls/id/950172
______________________________________________________________________


Vulnerability Note VU#950172

Dell OpenManage Server Administrator version 7.1.0.1 DOM-based XSS
vulnerability

Original Release date: 09 janv. 2013 | Last revised: 09 janv. 2013


Overview

Dell OpenManage Server Administrator version 7.1.0.1 and earlier
contains a DOM-based cross-site scripting vulnerability.


Description

CWE-79: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting')

Dell OpenManage Server Administrator version 7.1.01 and earlier
contains a DOM-based cross-site scripting vulnerability.

Example:
https://www.example.com:1311/help/sm/en/Output/wwhelp/wwhimpl/js/html/index_main.htm?topic="></iframe><iframe
src="javascript:alert(/xss/)

Note the affected file is located in multiple locations:
/help/sm/es/Output/wwhelp/wwhimpl/js/html/index_main.htm
/help/sm/ja/Output/wwhelp/wwhimpl/js/html/index_main.htm
/help/sm/de/Output/wwhelp/wwhimpl/js/html/index_main.htm
/help/sm/fr/Output/wwhelp/wwhimpl/js/html/index_main.htm
/help/sm/zh/Output/wwhelp/wwhimpl/js/html/index_main.htm
/help/hip/en/msgguide/wwhelp/wwhimpl/js/html/index_main.htm
/help/hip/en/msgguide/wwhelp/wwhimpl/common/html/index_main.htm
Impact

A remote attacker may be able to execute arbitrary script in the
context of the end-user's browser session.


Solution

We are currently unaware of a practical solution to this problem.

Restrict Access

The Dell OpenManage Server Administrator interface should not be
Internet facing.


Vendor Information (Learn More)

The vulnerability reporter has confirmed that Dell OpenManage Server
Administrator 6.5.0.1, 7.0.0.1 and 7.1.0.1 are affected by this
vulnerability.


Vendor	Status	Date Notified	Date Updated
Dell Computer Corporation, Inc.	Affected  20 Nov 2012  04 Jan 2013

If you are a vendor and your product is affected, let us know.
CVSS Metrics (Learn More)

Group 	Score 	Vector
Base 	5,0 	AV:N/AC:L/Au:N/C:N/I:P/A:N
Temporal 	3,6 	E:U/RL:W/RC:UC
Environmental 	1,4 	CDP:LM/TD:L/CR:ND/IR:ND/AR:ND


References

    http://cwe.mitre.org/data/definitions/79.html


Credit

Thanks to Tenable Network Security for reporting this vulnerability.

This document was written by Michael Orlando.


Other Information

    CVE IDs: CVE-2012-6272
    Date Public: 09 janv. 2013
    Date First Published: 09 janv. 2013
    Date Last Updated: 09 janv. 2013
    Document Revision: 5

Feedback

If you have feedback, comments, or additional information about this
vulnerability, please send us email.


======================================================================

                 =========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================