Multiple vulnerabilities have been reported in Symantec IM Manager, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a vulnerable system.

1) Input passed to the "refreshRateSetting" parameter in IMManager/Admin/IMAdminSystemDashboard.asp, "nav" and "menuitem" parameters in IMManager/Admin/IMAdminTOC_simple.asp, and "action" parameter in IMManager/Admin/IMAdminEdituser.asp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via the "rdProcess" parameter is not properly sanitised in IMManager/IMLogWeb/rdprocess.aspx before being used in "rdServer.ActionProcessor.ProcessAction()" calls. This can be exploited to inject and execute arbitrary shell commands.

Successful exploitation of this vulnerability may allow execution of arbitrary code.

The vulnerabilities are reported in version 8.4.17 and prior.

Solution
Update to version 8.4.18.

Provided and/or discovered by
1) Sow Ching Shiong via Secunia.
2) Andrea Micalizzi (rgod) via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Symantec:
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110929_00

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-294/

Deep Links
Links available to Secunia VIM customers