CVE:CVE-2012-2171
CNNVD:CNNVD-201206-393
基于DS系列设备中的IBM System Storage DS Storage Manager 10.83.xx.18之前版本中的Storage Manager Profiler中的ModuleServlet.do中存在SQL注入漏洞。远程攻击者可利用该漏洞通过state_viewmodulelog操作到ModuleServlet URI中的selectedModuleOnly参数执行任意SQL命令。
solution:Upgrade ibm ds_storage_manager_host_software to a higher version than 10.83,10.8,10.60.x5.14,and avoid the version (,10.83],10.8,10.60.x5.14; Upgrade ibm ds4100 to a higher version than *,1724,and avoid the version 1724; Upgrade ibm ds4200 to a higher version than 1814,and avoid the version 1814; Upgrade ibm ds4300 to a higher version than 1722,and avoid the version 1722; Upgrade ibm ds4400 to a higher version than 1742,and avoid the version 1742; Upgrade ibm ds4500 to a higher version than 1742,and avoid the version 1742; Upgrade ibm ds4700 to a higher version than 1814,and avoid the version 1814; Upgrade ibm ds4800 to a higher version than 1815,and avoid the version 1815; Upgrade ibm system_storage_dcs3700_storage_subsystem to a higher version than 1818,and avoid the version 1818; Upgrade ibm system_storage_ds3200 to a higher version than 1726,and avoid the version 1726; Upgrade ibm system_storage_ds3300 to a higher version than 1726,and avoid the version 1726; Upgrade ibm system_storage_ds3400 to a higher version than 1726,and avoid the version 1726; Upgrade ibm system_storage_ds3512 to a higher version than 1746,and avoid the version 1746; Upgrade ibm system_storage_ds3524 to a higher version than 1746,and avoid the version 1746; Upgrade ibm system_storage_ds3950_express to a higher version than 1814,and avoid the version 1814; Upgrade ibm system_storage_ds5020_disk_controller to a higher version than 1814-20a,and avoid the version 1814-20a; Upgrade ibm system_storage_ds5100_storage_controller to a higher version than 1818,and avoid the version 1818; Upgrade ibm system_storage_ds5300_storage_controller to a higher version than 1818,and avoid the version 1818