Secunia

A vulnerability has been reported in Symantec Norton Internet Security (NIS), which can be exploited by malicious people to conduct Cross-Site Scripting attacks against a user.

The vulnerability is caused due to missing input validation when a requested URL is included in a blocked site error message returned to the user. This can be exploited by inserting arbitrary HTML or script code, which will be executed in the user's browser session when viewed.

Successful exploitation requires knowledge of a site, which is in the Norton Parental Control blocked list.

Solution
A fix will be available via the LiveUpdate functionality.

Provided and/or discovered by
KrazySnake, Digital Pranksters.

Original Advisory
Norton Internet Security Blocked Sites XSS:
http://www.digitalpranksters.com/advisories/symantec/InternetSec2003.html

Symantec Network Internet Security (NIS) Blocked Site Return Messages Not Properly Validated:
http://www.sarc.com/avcenter/security/Content/2003.10.27.html

Deep Links
Links available in Customer Area