[NEWS] Cross Site Scripting Vulnerability Found in Apple Web Site

From: support@securiteam.com
Date: 12/26/02

  • Next message: support@securiteam.com: "[NT] Windows File Protection Arbitrary Certificate Chain Vulnerability" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 26 Dec 2002 22:37:34 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      Cross Site Scripting Vulnerability Found in Apple Web Site
    ------------------------------------------------------------------------

    SUMMARY

    A vulnerability in Apple's web site allows remote attackers to cause it to
    insert malicious HTML or JavaScript into existing web pages of Apple's web
    site.

    DETAILS

    Example:
    http://search.apple.com/s97is.vts?Action=FilterSearch&ResultTemplate=webx3.hts&ServerKey=Primary&filter=nullflt.hts&collname=apple&SearchPage=http://search.apple.com/&queryText=Apple+XSSy+K-Otik')</scr!pt><br&SEARCH%20=Search

    Vendor response:
    Apple has been contacted.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:consulting@k-otik.com>
    Bekrar Chaouki of K-Otik Security.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages

    • [NT] Vulnerability in HTML Help Allows Code Execution (MS05-001)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... * Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service ...
      (Securiteam)
    • [NT] Microsoft JScript Remote Code Execution (MS06-023)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... There is a remote code execution vulnerability in JScript. ... Configure Internet Explorer to prompt before running Active Scripting ...
      (Securiteam)
    • [NT] Cumulative Security Update for Internet Explorer (MS05-052)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... A remote code execution vulnerability exists in the way Internet Explorer ...
      (Securiteam)
    • [NT] Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (MS07-042)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Vulnerability in Microsoft XML Core Services Could Allow Remote Code ... mode sets the security level for the Internet zone to High. ...
      (Securiteam)
    • [NT] Microsoft Data Access Components (MDAC) Function Code Execution (MS06-014)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Microsoft Data Access Components Function Code Execution ... for the Internet security zone to prompt before running ActiveX controls. ...
      (Securiteam)