PT-2009-3504 · Dflabs · Dflabs Ptk

Gabriele Zanoni · Published 2009-03-16 · Updated 2017-08-17 · CVE-2009-0917

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DFLabs PTK versions 1.0.0 through 1.0.4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents. These documents are rendered in web browsers during inspection by PTK. The vendor notes that the product is intended for use in a laboratory with no internet contact.

Recommendations For DFLabs PTK versions 1.0.0 through 1.0.4, consider restricting the rendering of HTML documents from forensic images to minimize the risk of exploitation until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-0917

Affected Products

Dflabs Ptk

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-0917 · Security Note
• http://ptk.dflabs.com/faq.html · Vendor Advisory
• http://ptk.dflabs.com/security.html · Vendor Advisory
• http://securityfocus.com/bid/34111 · Note
• http://kb.cert.org/vuls/id/845747 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49236 · Note
• http://secunia.com/advisories/34257 · Note
• http://kb.cert.org/vuls/id/RGII-7Q4GBJ · Note