----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Nortel Alteon OS Script Insertion and Cross-Site Request Forgery

SECUNIA ADVISORY ID:
SA37395

VERIFY ADVISORY:
http://secunia.com/advisories/37395/

DESCRIPTION:
Two vulnerabilities have been reported in Nortel Alteon OS, which can
be exploited by malicious people to conduct script insertion and
cross-site request forgery attacks.

1) Input passed via the SSH log files is not properly sanitised
before being used in the Alteon OS Browser-Based Interface (BBI).
This can be exploited to insert arbitrary HTML and script code, which
will be executed in an administrator's browser session in context of
an affected site when the malicious login data is being viewed.

2) The Alteon OS BBI allows users to perform certain actions via HTTP
requests without performing any validation checks to verify the
requests. This can be exploited to e.g. change certain settings when
an logged-in administrative user visits a malicious web page.

The vulnerabilities are reported in version 21.0.8.3. Other versions
may also be affected.

SOLUTION:
Restrict access to the SSH interface. Do not browse untrusted sites
or follow untrusted links while being logged-in to the BBI.

PROVIDED AND/OR DISCOVERED BY:
Sintsov Alexey, Digital Security Research Group

ORIGINAL ADVISORY:
http://dsecrg.com/pages/vul/show.php?id=162

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------