NVD Vulnerability Detail

CVE-2011-0545

Summary	Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter.
Publication Date	March 29, 2011, 1:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:symantec:liveupdate_administrator:2.2.2.9:::::::*

Related information, measures and tools

No	URL	タグ
1	http://secunia.com/advisories/43820	Vendor Advisory
2	http://securityreason.com/securityalert/8160
3	http://securitytracker.com/id?1025242	Exploit
4	http://sotiriu.de/adv/NSOADV-2011-001.txt	Exploit
5	http://www.exploit-db.com/exploits/17026	Exploit
6	http://www.osvdb.org/71261
7	http://www.securityfocus.com/archive/1/517109/100/0/threaded
8	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
9	http://www.vupen.com/english/advisories/2011/0727	Vendor Advisory
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
11	http://secunia.com/advisories/43820	Vendor Advisory
12	https://exchange.xforce.ibmcloud.com/vulnerabilities/66213
13	http://www.vupen.com/english/advisories/2011/0727	Vendor Advisory
14	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
15	http://www.securityfocus.com/archive/1/517109/100/0/threaded
16	http://www.osvdb.org/71261
17	http://www.exploit-db.com/exploits/17026	Exploit
18	http://sotiriu.de/adv/NSOADV-2011-001.txt	Exploit
19	http://securitytracker.com/id?1025242	Exploit
20	http://securityreason.com/securityalert/8160

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

Symantec LUA の adduser.do におけるクロスサイトリクエストフォージェリの脆弱性

Title	Symantec LUA の adduser.do におけるクロスサイトリクエストフォージェリの脆弱性
Summary	Symantec LiveUpdate Administrator (LUA) の adduser.do には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	第三者により、userRole パラメータを介して、新規の管理アカウントを作成するための管理者認証をハイジャックされる、および詳細不明な影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 21, 2011, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

シマンテック

LiveUpdate Administrator 2.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0545	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0545
National Vulnerability Database (NVD)
2	CVE-2011-0545	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0545

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
Symantec Security Advisory
1	SYM11-005	http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00
シマンテックセキュリティ・アドバイザリー
2	SYM11-005	http://www.symantec.com/ja/jp/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.