Some vulnerabilities have been reported in 3Com Intelligent Management Center (IMC), which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, or disclose sensitive information.

1) Input passed via the "javax.faces.ViewState" parameter to imc/login.jsf and via the URL to e.g. imc/dwr/interface/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Access to the "reportscript/oracle/deploypara.properties" configuration file in the directory "/imc" and the "reportscript/sqlserver/deploypara.properties" configuration files in the directories "/imc" and "/rpt" is not properly restricted, which can be exploited to download the configuration files and disclose the e.g. SQL "sa" account password.

3) Access to imcws/services/listServices is not properly restricted, which can be exploited to disclose the configuration of supported web services.

4) It is possible to gain access to the administrative Axis2 console ("imcws/axis2-admin/") using default credentials.

5) Input passed via the "fileName" and "fileDir" parameters to /imc/report/DownloadReportSource is not properly verified before being used. This can be exploited to download arbitrary files from the local system via directory traversal attacks.

The vulnerabilities are reported in version 3.3.9 R2606 and 3.3 SP1 R2606.

Solution
Update to version 3.3 SP2 (R2606P13).

Provided and/or discovered by
Richard Brain of ProCheckUp Ltd

Original Advisory
3Com:
http://support.3com.com/documents/netmgr/imc/3Com_IMC_readme_plat_3.30-SP2.html

ProCheckUp:
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-01
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-02

Deep Links
Links available in Customer Area