Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Macromedia JRun Input Validation Flaws in Administrative Interface Permit Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1008300
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 26 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Version(s): 4 (build 61650)
|
Description: An input validation vulnerability was reported in Macromedia's JRun administrative interface. A remote user can conduct cross-site scripting attacks against JRun administrators to steal their authentication cookies and access the system.
dr_insane reported that serveral scripts fail to filter HTML scripting code from user-supplied input before displaying information
based on the user-supplied input. A remote user can create a specially crafted URL that, when loaded by a target administrator,
will cause arbitrary scripting code to be executed by the target administrator's browser. The code will originate from the site
running the vulnerable software and will run in the security context of that site. As a result, the code will be able to access
the target administrator's cookies (including authentication cookies), if any, associated with the site, access data recently submitted
by the target administrator via web form to the site, or take actions on the site acting as the target administrator.
Several
demonstration exploit URLs are provided:
http://[server]:8000/server/[your_server]/webserver/webserverlist.jsp?action=start&externalWebServer=DefaultDomain%3aservice%3
d[Javascript
code]
http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]
http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]&tabs=settings
http://[server]:8000/server/[your_server]/webserver/jrunwebserverconfig.jsp?webServerId=DefaultDomain%3aservice%3dWebService&isSSL=FALSE
http://[server]:8000/server/
[your_server]/serverframe.jsp?tabs=settings&subtabs=jvmsettings
|
Impact: A remote user can access the target administrator's cookies (including authentication cookies), if any, associated with the site
running the vulnerable software, access data recently submitted by the target administrator via web form to the site, or take actions
on the site acting as the target administrator.
|
Solution: No solution was available at the time of this entry.
The author of the report indicated that, as a workaround, you can disable the remote administrative interface.
|
Vendor URL: www.macromedia.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Red Hat), Linux (SuSE), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (Any)
|
Reported By: dr_insane@pathfinder.gr
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 25 Nov 2003 14:10:09 +0200
From: "=?windows-1253?B?w+nc7e3n8iDQ7+z+7efy?=" <dr_insane@pathfinder.gr>
Subject: [0day] dr_insane||Macromedia Jrun 4 (build 61650) web server remote
|
----------------------------------------------------------------------------------
Macromedia Jrun 4 (build 61650) web server remote administration CSS vulnerabilities
-----------------------------------------------------------------------------------
13/11/2003 (Revision 1)
Local:
------
Yes
Remote:
-------
yes
-------------------
Vendor Information:
-------------------
http://www.macromedia.com
--------------------------
Affected Versions/systems:
--------------------------
Solaris 7,8,9
Red Hat Linux 6.2, 7.x
SuSE Linux 7.3, 8.0
HP-UX 11i
IBM AIX 4.3, 5.x
Compaq Tru64 5.1 UNIX
Windows 98/ME/NT/2000/XP
-------------------
Description:
-------------------
I encountered some XSS security holes in Macromedia 4 (build 61650). it is possible
to steal cookies using these bugs and compromise the whole system.
-------------------
Exploit:
-------------------
http://[server]:8000/server/[your_server]/webserver/webserverlist.jsp?action=start&externalWebSer
ver=DefaultDomain%3aservice%3d[Javascript
code]
http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]
http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]&tabs=settings
http://[server]:8000/server/[your_server]/webserver/jrunwebserverconfig.jsp?webServerId=DefaultDomain
%3aservice%3dWebService&isSSL=FALSE
http://[server]:8000/server/[your_server]/serverframe.jsp?tabs=settings&subtabs=jvmsettings
-----------------
| SoLuTiOn |
-----------------
Disable the remote administration service.
-----------
| CONTACT |
-----------
dr_insane (dr_insane@pathfinder.gr)
http://members.lycos.co.uk/r34ct/
______________________________________________________________________________________
http://mobile.pathfinder.gr - Pathfinder Mobile logos & Ringtones!
http://www.pathfinder.gr - Δωρεάν mail από τον Pathfinder!
_______________________________________________
0day mailing list
0day@nothackers.org
http://nothackers.org/mailman/listinfo/0day
|
|
Go to the Top of This SecurityTracker Archive Page
|
