Details of VAR-201112-0239

ID

VAR-201112-0239

CVE

CVE-2011-4837

TITLE

HomeSeer HS2 Cross-Site Request Forgery Vulnerability

Trust: 1.6

sources: IVD: 7d79a980-463f-11e9-878a-000c29342cb1 // IVD: 50e488ba-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5659 // CNNVD: CNNVD-201112-272

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs. HomeSeer HS2 home automation software web interface contains multiple vulnerabilities. An attacker can request a WEB page like http://ipaddress/example<script>alert(document.cookie)</script> to store JavaScript in In the log view page. Viewing the log file by the administrator can cause JavaScript to execute in the target browser. A successful CSRFG attack allows an attacker to run commands as an administrator user. An HTML-injection vulnerability. 2. A cross-site request-forgery vulnerability. 3. A directory-traversal vulnerability. Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible. HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: HomeSeer HS2 Cross-Site Request Forgery and Script Insertion Vulnerabilities SECUNIA ADVISORY ID: SA47191 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47191/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47191 RELEASE DATE: 2011-12-09 DISCUSS ADVISORY: http://secunia.com/advisories/47191/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47191/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47191 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been discovered in HomeSeer HS2, which can be exploited by malicious people to conduct cross-site request forgery and script insertion attacks. 1) Input passed via the URL is not properly sanitised before being used. 2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. execute commands on a system by tricking a user into visiting a malicious web site. The vulnerabilities are confirmed in version 2.5.0.23. SOLUTION: Filter malicious characters and character sequences in a proxy. Do not browse untrusted websites or follow untrusted links while logged in to the application. PROVIDED AND/OR DISCOVERED BY: US-CERT credits Silent Dream ORIGINAL ADVISORY: US-CERT (VU#796883): http://www.kb.cert.org/vuls/id/796883 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 4.14

sources: NVD: CVE-2011-4837 // CERT/CC: VU#796883 // JVNDB: JVNDB-2011-003475 // CNVD: CNVD-2011-5659 // CNVD: CNVD-2011-5220 // BID: 50978 // IVD: 7d79a980-463f-11e9-878a-000c29342cb1 // IVD: 50e488ba-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 107711

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.6

sources: IVD: 7d79a980-463f-11e9-878a-000c29342cb1 // IVD: 50e488ba-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-5659 // CNVD: CNVD-2011-5220

AFFECTED PRODUCTS

vendor:	homeseer	model:	hs2	scope:	eq	version:	2.5.0.20	Trust: 3.9
vendor:	homeseer	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	homeseer hs2	model:	-	scope:	eq	version:	2.5.0.20	Trust: 0.4

sources: IVD: 7d79a980-463f-11e9-878a-000c29342cb1 // IVD: 50e488ba-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5659 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003475 // NVD: CVE-2011-4837 // CNNVD: CNNVD-201112-272

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2011-4837
value:	MEDIUM
Trust: 1.8
CARNEGIE MELLON:	VU#796883
value:	0.11
Trust: 0.8
CNVD:	CNVD-2011-5659
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201112-272
value:	MEDIUM
Trust: 0.6
IVD:	7d79a980-463f-11e9-878a-000c29342cb1
value:	MEDIUM
Trust: 0.2
IVD:	50e488ba-2354-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2

NVD:
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	TRUE
version:	2.0
Trust: 1.0
NVD:	CVE-2011-4837
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2011-5659
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d79a980-463f-11e9-878a-000c29342cb1
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	50e488ba-2354-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 7d79a980-463f-11e9-878a-000c29342cb1 // IVD: 50e488ba-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5659 // JVNDB: JVNDB-2011-003475 // NVD: CVE-2011-4837 // CNNVD: CNNVD-201112-272

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.8

sources: JVNDB: JVNDB-2011-003475 // NVD: CVE-2011-4837

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-272

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201112-272

CONFIGURATIONS

sources: NVD: CVE-2011-4837

PATCH

title:	HomeSeer Home Control Software HS2	url:	http://www.homeseer.com/products/software/hs_software.htm	Trust: 0.8
title:	Patch for HomeSeer HS2 Cross-Site Request Forgery Vulnerability	url:	https://www.cnvd.org.cn/patchinfo/show/37786	Trust: 0.6

sources: CNVD: CNVD-2011-5659 // JVNDB: JVNDB-2011-003475

EXTERNAL IDS

db:	CERT/CC	id:	VU#796883	Trust: 4.2
db:	NVD	id:	CVE-2011-4837	Trust: 3.7
db:	BID	id:	50978	Trust: 1.5
db:	CNVD	id:	CNVD-2011-5659	Trust: 1.0
db:	CNNVD	id:	CNNVD-201112-272	Trust: 1.0
db:	JVNDB	id:	JVNDB-2011-003475	Trust: 0.8
db:	CNVD	id:	CNVD-2011-5220	Trust: 0.6
db:	CNNVD	id:	CNNVD-201112-136	Trust: 0.6
db:	IVD	id:	7D79A980-463F-11E9-878A-000C29342CB1	Trust: 0.2
db:	IVD	id:	50E488BA-2354-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SECUNIA	id:	47191	Trust: 0.2
db:	PACKETSTORM	id:	107711	Trust: 0.1

sources: IVD: 7d79a980-463f-11e9-878a-000c29342cb1 // IVD: 50e488ba-2354-11e6-abef-000c29c66e3d // CERT/CC: VU#796883 // CNVD: CNVD-2011-5659 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003475 // PACKETSTORM: 107711 // NVD: CVE-2011-4837 // CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-272

REFERENCES

url:	http://www.kb.cert.org/vuls/id/796883	Trust: 3.4
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4837	Trust: 1.4
url:	about vulnerability notes	Trust: 0.8
url:	contact us about this vulnerability	Trust: 0.8
url:	provide a vendor statement	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4837	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu796883/	Trust: 0.8
url:	http://www.securityfocus.com/bid/50978	Trust: 0.6
url:	http://www.homeseer.com/downloads/	Trust: 0.3
url:	http://secunia.com/advisories/47191/#comments	Trust: 0.1
url:	http://secunia.com/company/jobs/	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=47191	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/47191/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CERT/CC: VU#796883 // CNVD: CNVD-2011-5659 // CNVD: CNVD-2011-5220 // BID: 50978 // JVNDB: JVNDB-2011-003475 // PACKETSTORM: 107711 // NVD: CVE-2011-4837 // CNNVD: CNNVD-201112-136 // CNNVD: CNNVD-201112-272

CREDITS

Silent Dream

Trust: 0.9

sources: BID: 50978 // CNNVD: CNNVD-201112-136

SOURCES

db:	IVD	id:	7d79a980-463f-11e9-878a-000c29342cb1
db:	IVD	id:	50e488ba-2354-11e6-abef-000c29c66e3d
db:	CERT/CC	id:	VU#796883
db:	CNVD	id:	CNVD-2011-5659
db:	CNVD	id:	CNVD-2011-5220
db:	BID	id:	50978
db:	JVNDB	id:	JVNDB-2011-003475
db:	PACKETSTORM	id:	107711
db:	NVD	id:	CVE-2011-4837
db:	CNNVD	id:	CNNVD-201112-136
db:	CNNVD	id:	CNNVD-201112-272

LAST UPDATE DATE

2023-12-18T12:10:17.486000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#796883	date:	2012-01-12T00:00:00
db:	CNVD	id:	CNVD-2011-5659	date:	2011-12-16T00:00:00
db:	CNVD	id:	CNVD-2011-5220	date:	2011-12-12T00:00:00
db:	BID	id:	50978	date:	2011-12-16T18:08:00
db:	JVNDB	id:	JVNDB-2011-003475	date:	2011-12-21T00:00:00
db:	NVD	id:	CVE-2011-4837	date:	2011-12-15T05:00:00
db:	CNNVD	id:	CNNVD-201112-136	date:	2011-12-12T00:00:00
db:	CNNVD	id:	CNNVD-201112-272	date:	2011-12-16T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	7d79a980-463f-11e9-878a-000c29342cb1	date:	2011-12-16T00:00:00
db:	IVD	id:	50e488ba-2354-11e6-abef-000c29c66e3d	date:	2011-12-16T00:00:00
db:	CERT/CC	id:	VU#796883	date:	2011-12-08T00:00:00
db:	CNVD	id:	CNVD-2011-5659	date:	2011-12-16T00:00:00
db:	CNVD	id:	CNVD-2011-5220	date:	2011-12-12T00:00:00
db:	BID	id:	50978	date:	2011-12-08T00:00:00
db:	JVNDB	id:	JVNDB-2011-003475	date:	2011-12-21T00:00:00
db:	PACKETSTORM	id:	107711	date:	2011-12-09T02:50:59
db:	NVD	id:	CVE-2011-4837	date:	2011-12-15T03:57:35.230
db:	CNNVD	id:	CNNVD-201112-136	date:	1900-01-01T00:00:00
db:	CNNVD	id:	CNNVD-201112-272	date:	2011-12-16T00:00:00