[security bulletin] HPSBST03000 rev.4 - HP StoreEver ESL G3 Tape Library and Enterprise Library LTO-6 Tape Drives running OpenSSL, Remote Disclosure of Information

Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c04260637

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c04260637
Version: 4

HPSBST03000 rev.4 - HP StoreEver ESL G3 Tape Library and Enterprise Library
LTO-6 Tape Drives running OpenSSL, Remote Disclosure of Information

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2014-04-22
Last Updated: 2014-06-30

Potential Security Impact: Remote disclosure of information

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP StoreEver ESL
G3 Tape Library and Enterprise Library LTO-6 Tape Drives running OpenSSL.
This is the OpenSSL vulnerability known as "Heartbleed" which could be
exploited remotely resulting in disclosure of information.

References: CVE-2014-0160, SSRT101513

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP StoreEver ESL G3 Tape Libraries with MCB rev 2  OpenSSL version 1.0.1f for
the following firmware versions:

671H_GS00601
665H_GS12501
663H_GS04601

HP StoreEver ESL G3 Tape Libraries with MCB rev 1  Open SSL version 1.0.1e in
655H firmware versions:

655H_GS10201

HP StoreEver Enterprise Library LTO-6 Tape Drives: all firmware versions.

BACKGROUND

CVSS 2.0 Base Metrics
==============================
=============================
  Reference              Base Vector             Base Score
CVE-2014-0160    (AV:N/AC:L/Au:N/C:P/I:N/A:N)       5.0
===========================================================
             Information on CVSS is documented
            in HP Customer Notice: HPSN-2008-002

RESOLUTION

HP has released the following firmware updates to resolve the vulnerability
for HP StoreEver ESL G3 Tape Library and HP StoreEver Enterprise Library
LTO-6 Tape Drives:

HP Product
 Firmware Version

HP StoreEver ESL G3 Tape Libraries with MCB rev 2
 672H_GS30301

HP StoreEver ESL G3 Tape Libraries with MCB rev 1
 655H_GS30501

HP StoreEver ESL G3 LTO-6 Ultrium 6650 FC Drive
 J3MW

The firmware is customer installable and is available in the Drivers,
Software & Firmware section at the following location:

http://www.hp.com/support/eslg3

ESA-2014-060: EMC Documentum eRoom Multiple Cross-Site Scripting Vulnerabilities

ESA-2014-060: EMC Documentum eRoom Multiple Cross-Site Scripting Vulnerabilities

EMC Identifier: ESA-2014-060

CVE Identifier: CVE-2014-2512

Severity Rating: CVSS v2 Base Score: 8 (AV:N/AC:L/Au:S/C:C/I:P/A:P) 

Affected products:  
? EMC Documentum eRoom 7.4.3
? EMC Documentum eRoom 7.4.4
? EMC Documentum eRoom 7.4.4 SP1

Summary: 
EMC Documentum eRoom versions 7.4.3, 7.4.4, and 7.4.4 SP1 contain multiple cross-site scripting vulnerabilities that could be potentially exploited by malicious users to compromise the affected system.

Details:  
EMC Documentum eRoom versions 7.4.3, 7.4.4, and 7.4.4 SP1 contains multiple cross-site scripting vulnerabilities. These vulnerabilities can be exploited by an authenticated malicious attacker to execute arbitrary HTML and script code in the context of an authenticated EMC Documentum eRoom user. 

Resolution:  
The following products contain the resolution to these issues:
? EMC Documentum eRoom 7.4.3 ESA-2014-060 (hot fix)
? EMC Documentum eRoom 7.4.4 P19 or later
? EMC Documentum eRoom 7.4.4 SP1 ESA-2014-060 (hot fix)

EMC recommends all customers to upgrade or apply the hot fixes provided for the versions listed above at the earliest opportunity. 

Link to remedies:
Customers can download the software from https://support.emc.com/downloads/5324_Documentum-eRoom 

Kerio Control <= 8.3.1 Boolean-based blind SQL Injection

Document Title:
======================
Kerio Control <= 8.3.1 Boolean-based blind SQL Injection

Primary Informations:
======================

Product Name: Kerio Control
Software Description: Kerio Control brings together multiple capabilities
 including a network firewall and router, intrusion detection and
 prevention (IPS), gateway anti-virus, VPN and content filtering. These
 comprehensive capabilities and unmatched deployment flexibility make
 Kerio Control the ideal choice for small and mid-sized businesses.
Affected Version: Latest Version - 8.3.1 (released on 2014-05-20)
Vendor Website: http://kerio.com
Vulnerability Type: Boolean-based blind SQL Injection
Severity Level: Very High
Exploitation Technique: Remote
CVE-ID: CVE-2014-3857
Discovered By: Khashayar Fereidani
Main Reference: http://fereidani.com/articles/show/76_kerio_control_8_3_1_boolean_based_blind_sql_injection
Researcher's Websites: http://fereidani.com http://fereidani.ir
                       http://und3rfl0w.com http://ircrash.com
Researcher's Email: info [ a t ] fereidani [ d o t ] com


Technical Details:
=======================

Kerio Control suffers from a SQL Injection Vulnerability which can lead to gain users
 sensitive informations like passwords , to use this vulnerability attacker need a
 valid client username and password .

Vulnerable path: /print.php
Vulnerable variables: x_16 and x_17
HTTP Method: GET

SEC Consult SA-20140701-0 :: Stored cross-site scripting vulnerabilities in EMC Documentum eRoom

SEC Consult Vulnerability Lab Security Advisory 20140701-0
============================================================
===========
              title: Stored cross-site scripting vulnerabilities
            product: EMC Documentum eRoom
 vulnerable version: 7.4.3, 7.4.4, 7.4.4 SP1
      fixed version: 7.4.3 ESA-2014-060 (hot fix)
                     7.4.4 P19
                     7.4.4 SP1 ESA-2014-060 (hot fix)
                CVE: CVE-2014-2512
             impact: high
           homepage: http://www.emc.com/products/detail/software2/eroom.htm
              found: 2013-11-25
                 by: M. Heinzl
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com/
=======================================================================


Vendor description:
- -------------------

"EMC Documentum eRoom is easy-to-use online team collaboration software that
enables distributed teams to work together more efficiently. With Documentum
eRoom, teams around the world can accelerate document collaboration and group
activities, improve the development and delivery of products and services,
optimize collaborative business processes, improve innovation, and streamline
decision-making."

http://www.emc.com/products/detail/software2/eroom.htm


Vulnerability overview/description:
- -----------------------------------

Documentum eRoom suffers from multiple permanent cross-site scripting
vulnerabilities, which allow an attacker to steal other user's sessions, to
impersonate other users and to gain unauthorized access to documents hosted in
eRooms. A JavaScript worm could be utilized to crawl an eRoom and gather all
available documents.

There are many parameters which are not properly sanitized and thus are
vulnerable to XSS.