|
 |
|
04WebServer Cross-Site Scripting and Security Bypass
|
|
|
|
|
Secunia Advisory:
|
SA21504
|
|
|
Release Date:
|
2006-08-14
|
|
Last Update:
|
2006-08-25
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Cross Site Scripting
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | 04WebServer 1.x
|
| | CVE reference: | CVE-2006-4199 (Secunia mirror)
CVE-2006-4200 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Two vulnerabilities have been reported in 04WebServer, which can be exploited by malicious people to conduct cross-site scripting attacks and bypass certain security restrictions.
1) Input passed via the URL is not properly sanitised before being returned to the user via an error page. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) An unspecified error in the request processing can be exploited to bypass the user identification.
The vulnerabilities have been reported in version 1.83 and prior.
Solution:
Update to version 1.84.
http://www.soft3304.net/04WebServer/Download/
Provided and/or discovered by:
1) HASEGAWA Yosuke
2) Yamagata21
Changelog:
2006-08-16: Updated "Provided and/or discovered by" section and added links to JP Vendor Status Notes.
2006-08-25: Added CVE references.
Original Advisory:
http://www.soft3304.net/04WebServer/Security.html
JP Vendor Status Notes:
http://jvn.jp/jp/JVN%2302091617/index.html
http://jvn.jp/jp/JVN%2327428836/index.html
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
2 Related Secunia Security Advisories
|
|
|
1. 04WebServer Directory Traversal Vulnerability
|
|
2. 04WebServer Three Vulnerabilities
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
