SPI Dynamics has discovered some vulnerabilities in RSSOwl, which can be exploited by malicious people to conduct script insertion attacks and potentially compromise a user's system.

The vulnerabilities are caused due to input validation errors in the processing of Atom feeds. This can be exploited to inject and execute arbitrary HTML and script code in context of the Atom feed by tricking a user into adding a malicious Atom feed and then viewing the content of it.

Successful exploitation allows execution of arbitrary script code in the "My Computer" zone on the Microsoft Windows platform.

The vulnerabilities have been confirmed in versions 1.2.1 and 1.2.2. Other versions may also be affected.

Solution
Do not add feeds from untrusted sources.

Provided and/or discovered by
SPI Dynamics

Original Advisory
SPI Dynamics:
http://www.cgisecurity.com/papers/RSS-Security.ppt

Deep Links
Links available in Customer Area