bugMHonArc - Bugs: bug #32013, CVE-2010-4524: Improper escaping...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #32013: CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)

Submitted by:  Earl Hood <ehood>
Submitted on:  Thu Dec 30 20:04:54 2010  
 
Category: MIME FilterSeverity: 6 - Security
Priority: 5 - NormalItem Group: Security
Status: FixedPrivacy: Public
Assigned to: Earl Hood <ehood>Open/Closed: Closed
Operating System: AllPerl Version: All
Component Version: 2.6.16Fixed Release: 2.6.17

Thu Dec 30 20:55:55 2010, comment #1:

mhtxthtml.pl filter modified to reject any message with
nested tags. This is invalid HTML, so any message
that contains it would likely indicate someone trying
to attack an archive web site.

Earl Hood <ehood>
Project AdministratorIn charge of this item.
Thu Dec 30 20:04:54 2010, original submission:

Specially crafted HTML email message can allow scripting
content to make it passed the default HTML MIME filter,
allowing for XSS-based attack on archive site.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=664718
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607693

Earl Hood <ehood>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by ehood (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun Jan 9 09:22:37 2011ehoodItem GroupUndesired Behavior=>Security
      Open/ClosedOpen=>Closed
    Sun Jan 9 08:35:54 2011ehoodStatusReady For Test=>Fixed
    Sun Jan 9 08:35:40 2011ehoodFixed Release=>2.6.17
    Thu Dec 30 20:55:55 2010ehoodStatusConfirmed=>Ready For Test
    Thu Dec 30 20:28:56 2010ehoodSummaryImproper escaping of certain HTML sequences (XSS) =>CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)

    Back to the top


    Powered by Savane 3.1-cleanup