[UNIX] Sambar Server Cross-Site Scripting Vulnerability (Results.stm)

From: support@securiteam.com
Date: 01/23/03

  • Next message: support@securiteam.com: "[NT] CuteFTP Buffer Overflow in LIST's Response" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 23 Jan 2003 18:10:01 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      Sambar Server Cross-Site Scripting Vulnerability (Results.stm)
    ------------------------------------------------------------------------

    SUMMARY

     <http://sambar.jalyn.net/> Sambar Server is the new standard in high
    performance multi-functional servers with features rivaling other
    commercial products selling separately for several hundreds of dollars. A
    cross-site scripting vulnerability in the product allows remote attackers
    to cause the product to return malicious HTML and JavaScript as if it were
    its own.

    DETAILS

    Vulnerable systems:
     * Sambar version 5.3 and prior

    An exploitable bug was found on Sambar Server that causes JavaScript
    execution on client's computer by following a crafted URL.

    This kind of attack known as "Cross-Site Scripting Vulnerability" is
    present in search section of the web site. Anyone can input specially
    crafted links and/or other malicious scripts.

    Exploit:
    http://localhost/search/results.stm?query=<
    script>alert('Test%20of%20vulnerability');</script>

    Vendor status:
    Sambar has been contacted.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:galiarept@security-corp.org>
    galiarept [security-corp].

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages

    • [NT] Netegrity SiteMinder smpwservicescgi.exe Target Redirection
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Due to improper filtering of user provided data, a remote attacker can ... This allows an attacker to redirect the user to whatever site ...
      (Securiteam)
    • [NT] WebArchiveX Unsafe Methods Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... String userAgent, ... scripting' entry, but unfortunately has not changed the version number. ...
      (Securiteam)
    • [NEWS] IBM Net.Data Macro Name Cross-Site Scripting Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The vulnerability is caused due to an input validation error in the db2www ... The vendor recommends that the "DTW_DEFAULT_ERROR_MESSAGE" feature (or ...
      (Securiteam)
    • [NEWS] TRUSTe.org Cross Site Scripting and Phishing Opportunities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... and guidance of many established companies and industry experts, TRUSTe ...
      (Securiteam)
    • [NT] FastStone 4in1 Browser Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... FastStone 4in1 Browser does not properly sanitize the directory reference ...
      (Securiteam)