Security Auditors Research Assistant banners cross-site scripting
| sara-banners-xss (14033) |  Medium Risk |
Description:
Security Auditor's Research Assistant (SARA ) is vulnerable to cross-site scripting, caused by improper filtering of user-supplied input. SARA uses a Web browser to allow information to be displayed, which includes banners from the service. If interactive mode is enabled when scanning, a remote attacker could create a specially-crafted service banner URL containing HTML on a site to be scanned, which would be executed within the security context of the hosting site, when the site is scanned. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials and other sensitive information.
Platforms Affected:
- Advanced Research Corporation, SARA 4.2.6
- Advanced Research Corporation, SARA 4.2.7
Remedy:
Upgrade to the latest version of SARA (5.0.0 or later), available from The Advanced Research Corporation Web site. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Wed Dec 17 2003 - 12:29:41 CST , Cross-site scripting vulnerability in SARA v<=4.2.7 at http://archives.neohapsis.com/archives/bugtraq/2003-12/0260.html.
- BugTraq Mailing List, Wed Dec 17 2003 - 20:51:34 CST, Re: Cross-site scripting vulnerability in SARA v<=4.2.7 at http://archives.neohapsis.com/archives/bugtraq/2003-12/0264.html.
- The Advanced Research Corporation Web site, The Advanced Research Corporation at http://www-arc.com/sara/.
- BID-9241: Advanced Research Security Auditor Research Assistant Service Banner HTML Injection Vulnerability
Reported:
Dec 17, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net