Namazu namazu.cgi tab query cross-site scripting
| namazu-tab-query-xss (18623) |  Medium Risk |
Description:
Namazu is vulnerable to cross-site scripting, caused by a vulnerability in the 'namazu.cgi' script. A remote attacker could send a specially-crafted query begining from a tab (%09) containing embedded script, which would be executed in the victim's Web browser within the security context of the hosting site, once the query is processed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- Debian, Debian Linux 3.0
- FedoraProject, Fedora Core 2
- Namazu, Namazu 2.0.13 and prior
Remedy:
Upgrade to the latest version of Namazu (2.0.14 or later), as listed in Secunia Security Advisory: SA13600. See References.
For Fedora Core 2:
Upgrade to the latest namazu package (2.0.14-0.FC2or later), as listed in Fedora Update Notification FEDORA-2004-557. See References.
For Fedora Core 3:
Upgrade to the latest namazu package (2.0.14-0.FC3 or later), as listed in Fedora Update Notification FEDORA-2004-558. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest namazu2 package (2.0.10-1woody3 or later), as listed in DSA-627-1. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Fedora Update Notification FEDORA-2004-557, namazu-2.0.14-0.FC2.0 update at http://www.linuxsecurity.com/content/view/117604/102/.
- BID-12053: Namazu Multiple Remote Vulnerabilities
- CVE-2004-1318: Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab (%09) character, which prevents the rest of the query from being properly sanitized.
- DSA-627: namazu2 -- unsanitised input
- OSVDB ID: 12516: Namazu namazu.cgi Tab Character XSS
- SA13600: Namazu "namazu.cgi" Cross-Site Scripting Vulnerability
- SECTRACK ID: 1012802: Namazu Tab Character Input Validation Error Lets Remote Users Conduct Cross-Site Scripting Attacks
- SECTRACK ID: 1012805: (Debian Issues Fix) Namazu Tab Character Input Validation Error Lets Remote Users Conduct Cross-Site Scripting Attacks
- SUSE-SR:2005:001: SUSE Security Summary Report
Reported:
Dec 21, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net