We just got
credits
for a flaw we found in SAP Netweaver. The issue is a reflected
Cross-Site Scripting
(XSS). It can be triggered in the administrative interface for the Internet
Communication Manager (ICM) and Web Dispatcher. This means that the targets for
this XSS will definitely be users with administrative privileges. This makes it
especially juicy for an attacker.
SAP rated the vulnerability with CVSS and a Base Score of 4.3 having a Base
Vector of AV:N/AC:M/AU:N/C:N/I:P/A:N. Which again opens the discussion on how
to rate the impact of XSS by using CVSS. CVSS
states that XSS
“should be scored with no impact to confidentiality or availability, and
partial impact to integrity“, which is clearly arguable. Especially when
thinking of the impact on confidentiality. As you might know by now, we tried to
tackle the problem of rating vulnerabilities ourselves with the
ERNW Rapid Rating System
(ERRS) and it was not an easy task. 😉 However, SAP states that this is a
correction with high priority, so you should apply the patches as soon as
possible.
During a recent research project we performed an in-depth security assessment of
Microsoft’s virtualization technologies, including Hyper-V and Azure. While we
already had experience in discovering security vulnerabilities in other virtual
environments (e.g.
here and
here), this was
our first research project on the Microsoft virtualization stack and we took
care to use a
structured evaluation strategy
to cover all potential attack vectors.
Part of our research concentrated on the Hyper-V hypervisor itself and we
discovered a critical vulnerability which can be exploited by an unprivileged
virtual machine to crash the hypervisor and potentially compromise other virtual
machines on the same physical host. This bug was recently patched, see
MS13-092 and
our
corresponding post.
The root cause of the vulnerability is Rails handling of formatted
parameters. In addition to standard GET and POST parameter formats, Rails can
handle multiple different data encodings inside the body of POST requests. By
default JSON and XML are supported. While support for JSON is widely used in
production, the XML functionality does not seem to be known by many Rails
developers.
2 AFFECTED PRODUCTS The following Products have been tested as vulnerable so far: Cisco Unified Meetingplace with the following modules: • MeetingPlace Agent 7.1.1.9 • MeetingPlace Audio Service 7.1.1.8 • MeetingPlace Gateway SIM 7.1.1.2 • MeetingPlace Replication Service 7.1.1.9 • MeetingPlace Master Service 7.1.1.8 • MeetingPlace Extension 7.1.1.8 • MeetingPlace Authentication Filter 7.1.1.8
3 DETAILS The following parameters are affected: http://$IP/mpweb/scripts/mpx.dll [POST Parameter wcRecurMtgID]
4 VULNERABILITY SCORING The severity rating based on CVSS Version 2: Base Vector: (AV:N / AC:L / Au:S / C:P / I:P / A:P) CVSS Version 2 Score: 6.5 Severity: Low
Microsoft takes this vulnerability quite serious and was acting fast. The
Microsoft Security Response Center announced the availability of a fix last
night in the
MSRC Blog.
The fix will be available via Windows Update on friday, the 21st of september.
So it’s time to get ready for this update ;-).
Actually a Windows Vulnerability
(Microsoft Advisory 2757760) related
to the Internet Explorer Version 7, 8 and 9 is in the news. Microsoft is aware
of the problem, but there’s no patch available yet. We call this a 0-Day :-).
Making the problem even worse, on monday reliable
exploit code
was released within the Metasploit project, so exploit code is already in the
wild.
Disabling Active X and Active Scripting in the Internet Settings
But both of them have some impact: EMET must be deployed before any usage (btw.
EMET can be configured via Group Policies) and disabling Active X and Active
Scripting might break some business relevant web sites (that can be added to the
“Trusted Sites” Zone, but might produce major operational effort).
Reading
this advisory
I’m quite tempted to emit another rant on the relationship of heavy use of 3rd
party components, lack of (security) quality assurance and services running at
times where they’re not needed (see second workaround
here).
I’ll refrain from that for today. Just wanted to let you know that the
underlying vulnerability
in Struts2 was initially discovered by Meder Kydyraliev who gives
this talk
at Troopers in two weeks. He’ll certainly describe the
inner workings of this one, and others… 😉
One of the four vulnerabilities rated “critical” from yesterday’s MS patchday,
that is
MS10-063,
has an interesting “Workarounds” section as for MS Internet Explorer. There it’s
stated:
“Disabling the support for the parsing of embedded fonts in Internet Explorer
prevents this application from being used as an attack vector.”
which, according to the advisory, should/can be done by setting the “Font
Downloading” parameter to “Disable”.
Which is exactly what
this document
suggests. So taking a preventive approach, once more, might have saved some
concerns (“Will we be targeted by this one”) and patch/testing time…
For those of you who missed it: Microsoft released the
associated advisory
yesterday, together with a hotfix
introducing a new registry key that allows users to control the DLL search path
algorithm. For a detailed explanation of the problem we refer to
the excellent article on Ars Technica.
For the record: no, AV (anti-virus software) will – in most cases – not protect
you from security problems related to this one. And, no, there is no easy patch
for this one either.