PT-2001-2003 · Mandrake · Webalizer

Published 2001-11-22 · Updated 2017-12-19 · CVE-2001-0835

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webalizer versions 2.01 through 2.06

Description A cross-site scripting issue allows remote attackers to inject arbitrary HTML tags into the system. This can be achieved by specifying the tags in search keywords embedded in HTTP referrer information or in host names retrieved via a reverse DNS lookup.

Recommendations For Webalizer versions 2.01 through 2.06, consider restricting access to the referrer information and limiting the ability to inject arbitrary HTML tags in host names until a patch is available. As a temporary workaround, disabling the feature to display referrer information and host names may help minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2001-0835

Affected Products

Webalizer

References · 11

• http://lists.suse.com/archives/suse-security-announce/2001-Nov/0001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-140.html · Vendor Advisory
• http://securityfocus.com/bid/3473 · Vendor Advisory
• http://mrunix.net/webalizer/news.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-141.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0835 · Security Note
• http://linuxsecurity.com/advisories/other_advisory-1677.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7351 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7350 · Note
• http://marc.info/?l=bugtraq&m=100394630702875&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0835 · Note