Two vulnerabilities have been reported in Hitachi JP1/HiCommand products, which can be exploited by malicious people to potentially bypass certain security restrictions or to conduct cross-site scripting attacks.

1) Input passed to the "Expect:" header in the JP1/HiCommand Suite Common Component web server is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An protocol rollback error in the JP1/HiCommand Suite Common Component web server can be exploited to replace the SSL 3.0 or TLS 1.0 protocol of a connection with the SSL 2.0 protocol.

This may be related to:
SA17151

The vulnerabilities are reported in the following products:
* JP1/HiCommand Device Manager
* JP1/HiCommand Tiered Storage Manager
* JP1/HiCommand Replication Monitor
* JP1/HiCommand GlobalLink Availability Manager

Solution
Please see the vendor advisory for fix details.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.hitachi-support.com/security_e/vuls_e/HS07-016_e/index-e.html
http://www.hitachi-support.com/security_e/vuls_e/HS07-017_e/index-e.html

Deep Links
Links available to Secunia VIM customers