PT-2008-4367 · Red Hat+1 · Red Hat Directory Server+2

Tomas Hoger · Published 2008-08-29 · Updated 2017-09-29 · CVE-2008-2929

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Directory Server versions 7.1 before SP7 Red Hat Directory Server 8 EL4 and EL5 Fedora Directory Server (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the adminutil library used by the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via input values that utilize % (percent) escaping.

Recommendations For Red Hat Directory Server versions 7.1 before SP7, update to SP7 or later to resolve the issue. For Red Hat Directory Server 8 EL4 and EL5, apply the appropriate patch or update to a version that includes the fix for this issue. For Fedora Directory Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2929

HPSBUX02354

RHSA-2008:0596

RHSA-2008:0601

Affected Products

Fedora Directory Server

Hp-Ux

Red Hat Directory Server

References · 22

• https://redhat.com/archives/fedora-package-announce/2008-September/msg00449.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2008-0596.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2928 · Security Note
• https://rhn.redhat.com/errata/RHSA-2008-0601.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2929 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00218.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 · Vendor Advisory
• http://redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html · Patch
• http://securityfocus.com/bid/30870 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2929 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3283 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2930 · Security Note
• http://vupen.com/english/advisories/2008/2480 · Note
• http://secunia.com/advisories/31777 · Note
• http://securitytracker.com/id?1020772 · Note