[UNIX] ViewVC Undefined Charset UTF-7 XSS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



ViewVC Undefined Charset UTF-7 XSS Vulnerability
------------------------------------------------------------------------


SUMMARY

<http://www.viewvc.org> ViewVC is "a browser interface for CVS and
Subversion version control repositories. It generates templatized HTML to
present navigable directory, revision, and change log listings. It can
display specific versions of files as well as diffs between those
versions. Basically, ViewVC provides the bulk of the report-like
functionality you expect out of your version control tool, but much more
prettily than the average textual command-line program output".

It was discovered that ViewVC is neither sending a charset HTTP header nor
specifying a charset in the HTML body. Therefore it is possible to trick
several browsers into decoding ViewVC pages UTF-7. This allows attackers
to inject arbitrary UTF-7 encoded Java-Script code into the output.

Please note that these UTF-7 attacks against sites with missing charset
definitions are also exploitable in the Mozilla browser family (seamonkey,
firefox, ...). Advisories from different parties that describe similar
vulnerabilities usually claim that only Internet Explorer with activated
auto-detection is vulnerable. In reality the mozilla browser family is
even more affected, because you can attack them no matter if charset
auto-detection is turned on or off.

DETAILS

Vulnerable Systems:
* ViewVC version 1.0.2 and prior

Immune Systems:
* ViewVC version 1.0.3 or newer

Disclosure Timeline:
07. October 2006 - Notified ViewVC developers
13. October 2006 - ViewVC developers release 1.0.3
15. October 2006 - Public Disclosure

Recommendation:
It is strongly recommended to upgrade to the newest version of ViewVC
1.0.3 which you can download at:
<http://viewvc.tigris.org/servlets/ProjectDocumentList?folderID=6004>
http://viewvc.tigris.org/servlets/ProjectDocumentList?folderID=6004


ADDITIONAL INFORMATION

The information has been provided by <mailto:sesser@xxxxxxxxxxxxxxxx>
Stefan Esser.
The original article can be found at:
<http://www.hardened-php.net/advisory_102006.134.html>
http://www.hardened-php.net/advisory_102006.134.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] Multiple Browsers Cross Domain Charset Inheritance Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Browsers Cross Domain Charset Inheritance Vulnerability ... Opera 9 ...
    (Securiteam)
  • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
    (Securiteam)
  • [UNIX] SCO Multiple Local Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
    (Securiteam)
  • [Full-disclosure] Advisory 10/2006: ViewVC Undefined Charset UTF-7 XSS Vulnerability
    ... ViewVC Undefined Charset UTF-7 XSS Vulnerability ...
    (Full-Disclosure)
  • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
    (Securiteam)