CERTA-2007-AVI-057

Vulnerability from certfr_avis - Published: - Updated:

Trois vulnérabilités sur Hitachi Web Server permettraient à une personne malintionnée d'exécuter une attaque de type cross-site scripting et/ou un contournement de la politique de sécurité.

Description

Trois vulnérabilités sont présentes sur Hitachi Web Server. La première concerne une vulnérabilité dans OpenSSL permettant de forcer le serveur à utiliser SSL 2.0 au lieu de SSL 3.0. Les deux autres vulnérabilités sont de type cross-site scripting. Pour plus d'informations, vous pouvez consulter les avis CERTA-2005-AVI-400 et CERTA-2005-AVI-490.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Centreon Web Hitachi uCosminexus Application Server Standard ;
Centreon Web Hitachi Cosminexus Enterprise Edition ;
Centreon Web Hitachi uCosminexus Service Architect ;
Centreon Web Hitachi Cosminexus Server Web Edition 0 et 4 ;
Centreon Web Hitachi Cosminexus Standard Edition 0 et 4 ;
Centreon Web Hitachi Cosminexus Developer 5 ;
Centreon Web Hitachi Cosminexus Application Server Enterprise 6 ;
Centreon Web Hitachi uCosminexus Service Platform ;
Centreon Web Hitachi Cosminexus Developer Professional 6 ;
Centreon Web Hitachi Web Server Custom Edition ;
Centreon Web Hitachi uCosminexus Application Server Enterprise ;
Centreon Web Hitachi uCosminexus Developer Standard ;
Centreon Web Hitachi Cosminexus Developer Standard 6 ;
Centreon Web Hitachi uCosminexus Application Server Smart Edition ;
Centreon Web Hitachi Cosminexus Application Server Standard 6 ;
Centreon Web Hitachi uCosminexus Developer Light ;
Centreon Web Hitachi Web Server for VOS3 ;
Centreon Web Hitachi Web Server Security Enhancement ;
Centreon Web Hitachi Cosminexus Application Server 5.
Centreon Web Hitachi Web Server ;
Centreon Web Hitachi uCosminexus Developer Professional ;
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Hitachi uCosminexus Application Server Standard ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Enterprise Edition ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Service Architect ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Server Web Edition 0 et 4 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Standard Edition 0 et 4 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Developer 5 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Application Server Enterprise 6 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Service Platform ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Developer Professional 6 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Web Server Custom Edition ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Application Server Enterprise ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Developer Standard ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Developer Standard 6 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Application Server Smart Edition ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Application Server Standard 6 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Developer Light ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Web Server for VOS3 ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Web Server Security Enhancement ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Cosminexus Application Server 5.",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi Web Server ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Hitachi uCosminexus Developer Professional ;",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Description\n\nTrois vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes sur Hitachi Web Server. La premi\u00e8re\nconcerne une vuln\u00e9rabilit\u00e9 dans OpenSSL permettant de forcer le serveur\n\u00e0 utiliser SSL 2.0 au lieu de SSL 3.0. Les deux autres vuln\u00e9rabilit\u00e9s\nsont de type cross-site scripting. Pour plus d\u0027informations, vous pouvez\nconsulter les avis CERTA-2005-AVI-400 et CERTA-2005-AVI-490.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2005-2969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-2969"
    },
    {
      "name": "CVE-2005-3352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-3352"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Hitachi du 24 janvier 2007 :",
      "url": "http://www.hitachi-support.com/security_e/vuls_e/HS06-022_e/01-e.html"
    },
    {
      "title": "Avis du CERTA du 15 d\u00e9cembre 2005 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2005-AVI-490/CERTA-2005-AVI-490.html"
    },
    {
      "title": "Avis du CERTA du 12 octobre 2005 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2005-AVI-400/CERTA-2005-AVI-400.html"
    }
  ],
  "reference": "CERTA-2007-AVI-057",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-01-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Trois vuln\u00e9rabilit\u00e9s sur \u003cspan class=\"textit\"\u003eHitachi Web Server\u003c/span\u003e\npermettraient \u00e0 une personne malintionn\u00e9e d\u0027ex\u00e9cuter une attaque de type\n\u003cspan class=\"textit\"\u003ecross-site scripting\u003c/span\u003e et/ou un contournement\nde la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9s sur Hitachi Web Server",
  "vendor_advisories": [
    {
      "published_at": "2007-01-24",
      "title": "Bulletin de s\u00e9curit\u00e9 Hitachi HS06-022",
      "url": "None"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.