[Japanese]

JVNDB-2010-000019

WebSAM DeploymentManager vulnerable to denial of service

Overview

WebSAM DeploymentManager contains a denial of service (DoS) vulnerability.

WebSAM DeploymentManager is a product that manages the distribution of security patches. WebSAM DeploymentManager contains a denial of service (DoS) vulnerability.

Servers or workstations that installed "Client Service for DPM" from the following products are vulnerable.
* WebSAM DeploymentManager Ver5.13 and earlier

The above mentioned WebSAM DeploymentManager is provided as part of the following products and are also affected by this vulnerability.
* SigmaSystemCenter 2.1 Update2 and earlier
* BladeSystemCenter all versions
* ExpressSystemCenter all versions
* VirtualPCCenter 2.2 and earlier
CVSS Severity (What is CVSS?)

Base Metrics: 7.8 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Complete

Affected Products


NEC Corporation
  • BladeSystemCenter all versions
  • ExpressSystemCenter all versions
  • SigmaSystemCenter 2.1 Update2 and earlier
  • VirtualPCCenter 2.2 and earlier
  • WebSAM DeploymentManager Ver5.13 and earlier

Impact

On a server or workstation with "Client Service for DPM" installed, a remote attacker may shut down or restart the operating system.
Solution

[Update the Software]
Update to the latest version according to the information provided by the developer.

[Filter traffic using a firewall]
Deny access to port 56010 for packets that do not have a source IP of the WebSAM DeploymentManager server.

For more information, refer to the developer's website.
Vendor Information

NEC Corporation
  • NEC Security Information : NV10-004 (Japanese)
CWE (What is CWE?)

  1. No Mapping(CWE-DesignError) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2010-1941
References

  1. JVN : JVN#90872372
  2. National Vulnerability Database (NVD) : CVE-2010-1941
  3. IPA SECURITY ALERTS : Security Alert for Vulnerability in WebSAM DeploymentManager
  4. Secunia Advisory : SA39802
  5. SecurityFocus : 40196
  6. OPEN SOURCE VULNERABILITY DATABASE (OSVDB) : 64700
Revision History

[2010/05/17]
  Web page published