bugMHonArc - Bugs: bug #32013, CVE-2010-4524: Improper escaping...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #32013: CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)

Submitter:  Earl Hood <ehood>
Submitted:  Thu 30 Dec 2010 08:04:54 PM UTC
 
Category:  MIME Filter Severity:  6 - Security
Priority:  * 5 - Normal Item Group:  Security
Status:  Fixed Privacy:  Public
Assigned to:  ehood Open/Closed:  Closed
Operating System:  * All Perl Version:  * All
Component Version:  * 2.6.16 Fixed Release:  2.6.17
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Thu 30 Dec 2010 08:55:55 PM UTC, comment #1: 

mhtxthtml.pl filter modified to reject any message with
nested tags.  This is invalid HTML, so any message
that contains it would likely indicate someone trying
to attack an archive web site.

Earl Hood <ehood>
Project Administrator
Thu 30 Dec 2010 08:04:54 PM UTC, original submission:  

Specially crafted HTML email message can allow scripting
content to make it passed the default HTML MIME filter,
allowing for XSS-based attack on archive site.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=664718
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607693

Earl Hood <ehood>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ehood (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-01-09 ehood Item GroupUndesired Behavior Security
        Open/ClosedOpen Closed
    2011-01-09 ehood StatusReady For Test Fixed
    2011-01-09 ehood Fixed Release 2.6.17
    2010-12-30 ehood StatusConfirmed Ready For Test
    2010-12-30 ehood SummaryImproper escaping of certain HTML sequences (XSS) CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)

    Back to the top


    Powered by Savane 3.9