PT-2001-2003 · Mandrake · Webalizer

Publicado 2001-11-22 · Atualizado 2017-12-19 · CVE-2001-0835

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webalizer versions 2.01 through 2.06

Description A cross-site scripting issue allows remote attackers to inject arbitrary HTML tags into the system. This can be achieved by specifying the tags in search keywords embedded in HTTP referrer information or in host names retrieved via a reverse DNS lookup.

Recommendations For Webalizer versions 2.01 through 2.06, consider restricting access to the referrer information and limiting the ability to inject arbitrary HTML tags in host names until a patch is available. As a temporary workaround, disabling the feature to display referrer information and host names may help minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2001-0835

Produtos afetados

Webalizer

Referências · 11

• http://lists.suse.com/archives/suse-security-announce/2001-Nov/0001.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2001-140.html · Aviso do Fabricante
• http://securityfocus.com/bid/3473 · Aviso do Fabricante
• http://mrunix.net/webalizer/news.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7351 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7350 · Nota
• http://redhat.com/support/errata/RHSA-2001-141.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-0835 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=100394630702875&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0835 · Nota
• http://linuxsecurity.com/advisories/other_advisory-1677.html · Aviso do Fabricante