Secunia

Multiple vulnerabilities have been reported in Tcl Web Server, which can be exploited by malicious people to see the contents of directories and conduct Cross Site Scripting.

1) Tcl Web Server fails to verify input properly when sorting a directory listing. This can be exploited by supplying an arbitrary directory to be sorted.

Example:
?pattern=/absolute/path/*&sort=name

2) Multiple modules (Status, Debug, Mail, Admin) have been reported to be vulnerable to Cross Site Scripting. This can be exploited by including arbitrary HTML and script code in various parameters.

Examples:
/debug/echo?name=<evil_script>
/debug/dbg?host=<evil_script>

The vulnerabilities have been reported in version 3.4.2. However, prior versions may also be affected.

Solution
Disable the affected modules, or use a firewall or proxy with URL filtering capabilities to filter malicious requests.

Provided and/or discovered by
Phuong Nguyen

Deep Links
Links available in Customer Area