bugMHonArc - Bugs: bug #1468, XSS vulnerability in message...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #1468: XSS vulnerability in message header conversion

Submitted by:  Earl Hood <ehood>
Submitted on:  Mon 21 Oct 2002 04:51:05 PM UTC  
 
Category: Mail ParsingSeverity: 6 - Security
Priority: 9 - ImmediateItem Group: Security
Status: FixedPrivacy: Public
Assigned to: Earl Hood <ehood>Open/Closed: Closed
Operating System: AllPerl Version: all
Component Version: <=2.5.12Fixed Release: 2.5.13

Mon 21 Oct 2002 04:52:44 PM UTC, comment #1:

Escaping of the field labels added to htmlize_header()
function in mhutil.pl. This should close the vulnerability.
Fixed will be included in 2.5.13 release.

Earl Hood <ehood>
Project AdministratorIn charge of this item.
Mon 21 Oct 2002 04:51:05 PM UTC, original submission:

(Orginally submitted by Steven M. Christey via private mail)
1) Cross-site scripting (XSS) possibilities

- XSS can be inserted into the message MIME header names, e.g.:

To: <someone@example.com>
From: <hacker@example.com>
Header<SCRIPT>hello</SCRIPT>def: whatever

Fix: apply the "HTML quoting" capability to all header names and
values.

User workaround: remove the "-extra-" option from the "FieldOrder"
resource, which says which headers should be archived.

Earl Hood <ehood>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 21 Oct 2002 04:52:44 PM UTCehoodStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)
  Fixed Release=>

Back to the top


Powered by Savane 3.1-cleanup1