Details of VAR-201112-0238

ID

VAR-201112-0238

CVE

CVE-2011-4836

TITLE

HomeSeer HS2 Cross-Site Scripting Vulnerability

Trust: 1.6

sources: IVD: 7d75d8ef-463f-11e9-b1ad-000c29342cb1 // IVD: 505aae7e-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5660 // CNNVD: CNNVD-201112-271

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to inject arbitrary web script or HTML via a request for a crafted URI. HomeSeer HS2 home automation software web interface contains multiple vulnerabilities. An attacker can request a WEB page like http://ipaddress/example<script>alert(document.cookie)</script> to store JavaScript in In the log view page. Viewing the log file by the administrator can cause JavaScript to execute in the target browser. A successful CSRFG attack allows an attacker to run commands as an administrator user. An HTML-injection vulnerability. 2. A cross-site request-forgery vulnerability. 3. A directory-traversal vulnerability. Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible. HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: HomeSeer HS2 Cross-Site Request Forgery and Script Insertion Vulnerabilities SECUNIA ADVISORY ID: SA47191 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47191/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47191 RELEASE DATE: 2011-12-09 DISCUSS ADVISORY: http://secunia.com/advisories/47191/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47191/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47191 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been discovered in HomeSeer HS2, which can be exploited by malicious people to conduct cross-site request forgery and script insertion attacks. 1) Input passed via the URL is not properly sanitised before being used. 2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. execute commands on a system by tricking a user into visiting a malicious web site. The vulnerabilities are confirmed in version 2.5.0.23. SOLUTION: Filter malicious characters and character sequences in a proxy. Do not browse untrusted websites or follow untrusted links while logged in to the application. PROVIDED AND/OR DISCOVERED BY: US-CERT credits Silent Dream ORIGINAL ADVISORY: US-CERT (VU#796883): http://www.kb.cert.org/vuls/id/796883 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 4.14

sources: NVD: CVE-2011-4836 // CERT/CC: VU#796883 // JVNDB: JVNDB-2011-003474 // CNVD: CNVD-2011-5660 // CNVD: CNVD-2011-5220 // BID: 50978 // IVD: 7d75d8ef-463f-11e9-b1ad-000c29342cb1 // IVD: 505aae7e-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 107711

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.6

sources: IVD: 7d75d8ef-463f-11e9-b1ad-000c29342cb1 // IVD: 505aae7e-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5660 // CNVD: CNVD-2011-5220

AFFECTED PRODUCTS

vendor:	homeseer	model:	hs2	scope:	eq	version:	2.5.0.20	Trust: 3.9
vendor:	homeseer	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	homeseer hs2	model:	-	scope:	eq	version:	2.5.0.20	Trust: 0.4

sources: IVD: 7d75d8ef-463f-11e9-b1ad-000c29342cb1 // IVD: 505aae7e-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5660 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003474 // NVD: CVE-2011-4836 // CNNVD: CNNVD-201112-271

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2011-4836
value:	MEDIUM
Trust: 1.8
CARNEGIE MELLON:	VU#796883
value:	0.11
Trust: 0.8
CNVD:	CNVD-2011-5660
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201112-271
value:	MEDIUM
Trust: 0.6
IVD:	7d75d8ef-463f-11e9-b1ad-000c29342cb1
value:	MEDIUM
Trust: 0.2
IVD:	505aae7e-2354-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2

NVD:
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	TRUE
version:	2.0
Trust: 1.0
NVD:	CVE-2011-4836
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2011-5660
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d75d8ef-463f-11e9-b1ad-000c29342cb1
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	505aae7e-2354-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 7d75d8ef-463f-11e9-b1ad-000c29342cb1 // IVD: 505aae7e-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5660 // JVNDB: JVNDB-2011-003474 // NVD: CVE-2011-4836 // CNNVD: CNNVD-201112-271

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2011-003474 // NVD: CVE-2011-4836

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-271

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201112-271

CONFIGURATIONS

sources: NVD: CVE-2011-4836

PATCH

title:	HomeSeer Home Control Software HS2	url:	http://www.homeseer.com/products/software/hs_software.htm	Trust: 0.8
title:	Patch for HomeSeer HS2 Cross-Site Scripting Vulnerability	url:	https://www.cnvd.org.cn/patchinfo/show/37787	Trust: 0.6

sources: CNVD: CNVD-2011-5660 // JVNDB: JVNDB-2011-003474

EXTERNAL IDS

db:	CERT/CC	id:	VU#796883	Trust: 4.2
db:	NVD	id:	CVE-2011-4836	Trust: 3.7
db:	BID	id:	50978	Trust: 1.5
db:	CNVD	id:	CNVD-2011-5660	Trust: 1.0
db:	CNNVD	id:	CNNVD-201112-271	Trust: 1.0
db:	JVNDB	id:	JVNDB-2011-003474	Trust: 0.8
db:	CNVD	id:	CNVD-2011-5220	Trust: 0.6
db:	CNNVD	id:	CNNVD-201112-136	Trust: 0.6
db:	IVD	id:	7D75D8EF-463F-11E9-B1AD-000C29342CB1	Trust: 0.2
db:	IVD	id:	505AAE7E-2354-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SECUNIA	id:	47191	Trust: 0.2
db:	PACKETSTORM	id:	107711	Trust: 0.1

sources: IVD: 7d75d8ef-463f-11e9-b1ad-000c29342cb1 // IVD: 505aae7e-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5660 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003474 // PACKETSTORM: 107711 // NVD: CVE-2011-4836 // CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-271

REFERENCES

url:	http://www.kb.cert.org/vuls/id/796883	Trust: 3.4
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4836	Trust: 1.4
url:	about vulnerability notes	Trust: 0.8
url:	contact us about this vulnerability	Trust: 0.8
url:	provide a vendor statement	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4836	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu796883/	Trust: 0.8
url:	http://www.securityfocus.com/bid/50978	Trust: 0.6
url:	http://www.homeseer.com/downloads/	Trust: 0.3
url:	http://secunia.com/advisories/47191/#comments	Trust: 0.1
url:	http://secunia.com/company/jobs/	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=47191	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/47191/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CERT/CC: VU#796883 // CNVD: CNVD-2011-5660 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003474 // PACKETSTORM: 107711 // NVD: CVE-2011-4836 // CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-271

CREDITS

Silent Dream

Trust: 0.9

sources: BID: 50978 // CNNVD: CNNVD-201112-136

SOURCES

db:	IVD	id:	7d75d8ef-463f-11e9-b1ad-000c29342cb1
db:	IVD	id:	505aae7e-2354-11e6-abef-000c29c66e3d
db:	CERT/CC	id:	VU#796883
db:	CNVD	id:	CNVD-2011-5660
db:	CNVD	id:	CNVD-2011-5220
db:	BID	id:	50978
db:	JVNDB	id:	JVNDB-2011-003474
db:	PACKETSTORM	id:	107711
db:	NVD	id:	CVE-2011-4836
db:	CNNVD	id:	CNNVD-201112-136
db:	CNNVD	id:	CNNVD-201112-271

LAST UPDATE DATE

2023-12-18T12:10:17.539000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#796883	date:	2012-01-12T00:00:00
db:	CNVD	id:	CNVD-2011-5660	date:	2011-12-16T00:00:00
db:	CNVD	id:	CNVD-2011-5220	date:	2011-12-12T00:00:00
db:	BID	id:	50978	date:	2011-12-16T18:08:00
db:	JVNDB	id:	JVNDB-2011-003474	date:	2011-12-21T00:00:00
db:	NVD	id:	CVE-2011-4836	date:	2011-12-15T19:54:36.887
db:	CNNVD	id:	CNNVD-201112-136	date:	2011-12-12T00:00:00
db:	CNNVD	id:	CNNVD-201112-271	date:	2011-12-16T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	7d75d8ef-463f-11e9-b1ad-000c29342cb1	date:	2011-12-16T00:00:00
db:	IVD	id:	505aae7e-2354-11e6-abef-000c29c66e3d	date:	2011-12-16T00:00:00
db:	CERT/CC	id:	VU#796883	date:	2011-12-08T00:00:00
db:	CNVD	id:	CNVD-2011-5660	date:	2011-12-16T00:00:00
db:	CNVD	id:	CNVD-2011-5220	date:	2011-12-12T00:00:00
db:	BID	id:	50978	date:	2011-12-08T00:00:00
db:	JVNDB	id:	JVNDB-2011-003474	date:	2011-12-21T00:00:00
db:	PACKETSTORM	id:	107711	date:	2011-12-09T02:50:59
db:	NVD	id:	CVE-2011-4836	date:	2011-12-15T03:57:35.200
db:	CNNVD	id:	CNNVD-201112-136	date:	1900-01-01T00:00:00
db:	CNNVD	id:	CNNVD-201112-271	date:	2011-12-16T00:00:00