PT-2007-7498 · Htdig+2 · Htdig+2

Published 1970-01-01 · Updated 2017-09-29 · CVE-2007-6110

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions htdig version 3.2.0b6

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the sort parameter in the htsearch component of htdig. Multiple vulnerabilities in the htdig package of the Debian GNU/Linux operating system can lead to a breach of protected information integrity, and these vulnerabilities can be exploited remotely.

Recommendations For htdig version 3.2.0b6, consider disabling the sort parameter in the htsearch component until a patch is available to prevent exploitation of the XSS vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-02879

BDU:2015-02880

CVE-2007-6110

DSA-1429-1

RHSA-2007:1095

RHSA-2007_1095

Affected Products

Debian

Red Hat

Htdig

References · 25

• 🔥 https://exploit-db.com/exploits/30818 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2007-6110 · Vendor Advisory
• http://secunia.com/advisories/27890 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6110 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6110 · Vendor Advisory
• http://secunia.com/advisories/27850 · Vendor Advisory
• http://secunia.com/advisories/27965 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02879 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-6110 · Security Note
• https://osv.dev/vulnerability/CVE-2007-6110 · Vendor Advisory
• http://secunia.com/advisories/28062 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_25_sr.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-1095.html · Vendor Advisory
• http://debian.org/security/2007/dsa-1429 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00116.html · Vendor Advisory