Sign-up

ID

VAR-201208-0270


CVE

CVE-2012-4276


TITLE

Hitachi IT Operations Director Denial of Service Vulnerability

Trust: 1.8

sources: CNVD: CNVD-2012-8370 // CNVD: CNVD-2012-2536 // CNNVD: CNNVD-201208-181

DESCRIPTION

Unspecified vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows attackers to cause a denial of service via unknown attack vectors. Hitachi IT Operations Director is systems management software that automatically correlates tasks with the IT infrastructure lifecycle. Because the program does not adequately handle user-supplied input, an attacker could use the vulnerability to execute arbitrary script code in a trusted user's browser in the context of the affected site, steal cookie-based authentication credentials, and launch other attacks. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Hitachi IT Operations Director Cross-Site Scripting and Denial of Service Vulnerabilities SECUNIA ADVISORY ID: SA49144 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49144/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49144 RELEASE DATE: 2012-05-14 DISCUSS ADVISORY: http://secunia.com/advisories/49144/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49144/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49144 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been reported in Hitachi IT Operations Director, which can be exploited by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service). 1) Certain unspecified input is not properly sanitised before being returned to the user. 2) An unspecified error can be exploited to cause a crash. No further information is currently available. The vulnerabilities are reported in versions 02-50-01 through 02-50-07 and 03-00 through 03-00-07. SOLUTION: Update or upgrade to version 03-00-08. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: HS12-014: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-014/index.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.87

sources: NVD: CVE-2012-4276 // JVNDB: JVNDB-2012-003612 // CNVD: CNVD-2012-8370 // CNVD: CNVD-2012-2535 // CNVD: CNVD-2012-2536 // BID: 53504 // BID: 78142 // PACKETSTORM: 112669

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.8

sources: CNVD: CNVD-2012-8370 // CNVD: CNVD-2012-2535 // CNVD: CNVD-2012-2536

AFFECTED PRODUCTS

vendor:hitachimodel:it operations directorscope:eqversion:02-50-01

Trust: 4.0

vendor:hitachimodel:it operations directorscope:eqversion:03-00-07

Trust: 3.4

vendor:hitachimodel:it operations directorscope:eqversion:02-50-06

Trust: 3.4

vendor:hitachimodel:it operations directorscope:eqversion:02-50-07

Trust: 3.4

vendor:hitachimodel:it operations directorscope:eqversion:03-00

Trust: 3.4

vendor:hitachimodel:it operations directorscope:eqversion:03-00-04

Trust: 3.4

vendor:hitachimodel:it operations directorscope:eqversion:03-00-06

Trust: 1.5

vendor:hitachimodel:it operations directorscope: - version: -

Trust: 0.8

vendor:hitachimodel:it operations directorscope:neversion:03-00-08

Trust: 0.3

sources: CNVD: CNVD-2012-8370 // CNVD: CNVD-2012-2535 // CNVD: CNVD-2012-2536 // BID: 53504 // BID: 78142 // JVNDB: JVNDB-2012-003612 // CNNVD: CNNVD-201208-181 // NVD: CVE-2012-4276

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-4276
value: MEDIUM

Trust: 1.0

NVD: CVE-2012-4276
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2012-8370
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201208-181
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2012-4276
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2012-8370
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2012-8370 // JVNDB: JVNDB-2012-003612 // CNNVD: CNNVD-201208-181 // NVD: CVE-2012-4276

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2012-4276

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201210-479 // CNNVD: CNNVD-201208-181

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 112669 // CNNVD: CNNVD-201210-479

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-003612

PATCH
title:HS12-014url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-014/index.html
Trust: 0.8
title:HS12-014url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-014/index.html
Trust: 0.8
title:Patch for Hitachi IT Operations Director Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/36876
Trust: 0.6
title:Patch for Hitachi IT Operations Director Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/16957
Trust: 0.6
title:Patch for Hitachi IT Operations Director Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/16956
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-8370 // 
            
            
            
            CNVD: CNVD-2012-2535 // 
            
            
            
            CNVD: CNVD-2012-2536 // 
            
            
            
            JVNDB: JVNDB-2012-003612

EXTERNAL IDS
db:NVDid:CVE-2012-4276
Trust: 3.3
db:SECUNIAid:49144
Trust: 2.4
db:HITACHIid:HS12-014
Trust: 2.3
db:BIDid:53504
Trust: 2.1
db:JVNDBid:JVNDB-2012-003612
Trust: 0.8
db:CNVDid:CNVD-2012-8370
Trust: 0.6
db:CNVDid:CNVD-2012-2535
Trust: 0.6
db:CNVDid:CNVD-2012-2536
Trust: 0.6
db:CNNVDid:CNNVD-201210-479
Trust: 0.6
db:CNNVDid:CNNVD-201208-181
Trust: 0.6
db:BIDid:78142
Trust: 0.3
db:PACKETSTORMid:112669
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-8370 // 
            
            
            
            CNVD: CNVD-2012-2535 // 
            
            
            
            CNVD: CNVD-2012-2536 // 
            
            
            
            BID: 53504 // 
            
            
            
            BID: 78142 // 
            
            
            
            JVNDB: JVNDB-2012-003612 // 
            
            
            
            PACKETSTORM: 112669 // 
            
            
            
            CNNVD: CNNVD-201210-479 // 
            
            
            
            CNNVD: CNNVD-201208-181 // 
            
            
            
            NVD: CVE-2012-4276

REFERENCES
url:http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-014/index.html
Trust: 2.3
url:http://secunia.com/advisories/49144
Trust: 2.2
url:http://www.securityfocus.com/bid/53504
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4276
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4276
Trust: 0.8
url:http://www.hitachi.com/index.html
Trust: 0.3
url:http://www.itoperations.com/
Trust: 0.3
url:http://secunia.com/advisories/49144/
Trust: 0.1
url:http://secunia.com/psi_30_beta_launch
Trust: 0.1
url:http://secunia.com/advisories/49144/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49144
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-8370 // 
            
            
            
            CNVD: CNVD-2012-2535 // 
            
            
            
            CNVD: CNVD-2012-2536 // 
            
            
            
            BID: 53504 // 
            
            
            
            BID: 78142 // 
            
            
            
            JVNDB: JVNDB-2012-003612 // 
            
            
            
            PACKETSTORM: 112669 // 
            
            
            
            CNNVD: CNNVD-201210-479 // 
            
            
            
            CNNVD: CNNVD-201208-181 // 
            
            
            
            NVD: CVE-2012-4276

CREDITS
The vendor reported these issues.
Trust: 0.3
sources:
            
            
            BID: 53504

SOURCES
db:CNVDid:CNVD-2012-8370
db:CNVDid:CNVD-2012-2535
db:CNVDid:CNVD-2012-2536
db:BIDid:53504
db:BIDid:78142
db:JVNDBid:JVNDB-2012-003612
db:PACKETSTORMid:112669
db:CNNVDid:CNNVD-201210-479
db:CNNVDid:CNNVD-201208-181
db:NVDid:CVE-2012-4276

LAST UPDATE DATE
2025-04-11T22:53:39.576000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-8370date:2012-08-14T00:00:00
db:CNVDid:CNVD-2012-2535date:2012-05-16T00:00:00
db:CNVDid:CNVD-2012-2536date:2012-05-16T00:00:00
db:BIDid:53504date:2012-05-14T00:00:00
db:BIDid:78142date:2012-08-13T00:00:00
db:JVNDBid:JVNDB-2012-003612date:2012-08-15T00:00:00
db:CNNVDid:CNNVD-201210-479date:2012-10-22T00:00:00
db:CNNVDid:CNNVD-201208-181date:2012-08-14T00:00:00
db:NVDid:CVE-2012-4276date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2012-8370date:2012-08-14T00:00:00
db:CNVDid:CNVD-2012-2535date:2012-05-16T00:00:00
db:CNVDid:CNVD-2012-2536date:2012-05-16T00:00:00
db:BIDid:53504date:2012-05-14T00:00:00
db:BIDid:78142date:2012-08-13T00:00:00
db:JVNDBid:JVNDB-2012-003612date:2012-08-15T00:00:00
db:PACKETSTORMid:112669date:2012-05-14T04:21:15
db:CNNVDid:CNNVD-201210-479date:2012-05-14T00:00:00
db:CNNVDid:CNNVD-201208-181date:2012-08-14T00:00:00
db:NVDid:CVE-2012-4276date:2012-08-13T22:55:01.693