[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability
- From: alex_haynes@xxxxxxxxxxx
- Date: Tue, 3 Feb 2015 08:28:34 GMT
Exploit Title: Landesk Management Suite Cross-Site scripting
vulnerabilityProduct: Landesk Management Suite
Vulnerable Versions: 9.5 (possible previous versions), 9.6
Tested Version: 9.5
Advisory Publication: Feb 02, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-5360
Advisory Details:
(1) Vendor & Product Description
Vendor:LANDESK
Product & Version:Landesk Management Suite v9.5
Vendor URL & Download:http://www.landesk.com/products/management-suite/
Product Description:"Manage all your users? multi-platform desktops and mobile
devices. Integrate several IT
disciplinesinto a single management experience that speeds software
distribution, ensures software license compliance,
simplifies OS provisioning, saves power costs, provides secure remote control,
and manages Mac OS X."
(2) Vulnerability Details:
The admin interface of Landesk Management Suite can be exploited by
XSS attacks.
Proof of concept:URL:
https://<LANDESK>/remote/serverlist_grouptree.aspx?AMTVersion=+alert(5)
Parameter name: AMTVersion
Parameter Type: GET
Attack Pattern: +alert(5)
(3) Advisory Timeline:
15/09/2014 - First Contact
19/12/2014 - Vulnerability fixed
02/02/2015 - Advisory released
(4)Solution:
Upgrade to version 9.6 SP1 which includes a fix for this vulnerability
(5) Credits:Alex Haynes
References:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5360