Full Disclosure mailing list archives
Sawmill XSS vuln
From: Mark Terry <Mark.Terry () nta-monitor com>
Date: Mon, 12 Sep 2005 16:08:01 +0100
This has been delayed until the vendor had released a new version: <<<<SNIP>>>>> Date: Fri, 26 Aug 2005 11:48:48 -0700 From: Greg Ferrar <ferrar () flowerfire com> User-Agent: Mozilla Thunderbird 1.0.2 (Macintosh/20050317) X-Accept-Language: en-us, en To: Terence.Wong () nta-monitor com Cc: support () sawmill co uk Subject: Re: FW: XSS vulnerability X-Scanned-By: MIMEDefang 2.48 on 192.168.124.1 Terence, Thank you for reporting this vulerability in Sawmill. We have researched this, and verified this vulnerability. This vulnerability exists in Sawmill version 7.0.0 through 7.1.13. All platforms, including Windows, are vulerable to this attack. We have fixed this in the latest internal version, by replacing < and < and > with >, and & with &, in the error message. You can get a pre-release with the fix from http://sawmill.net/prerelease.html . We plan to ship Sawmill 7.1.14 next week, probably next Friday. It is possible it will be delayed by as much as a week. So as a tentative timeline, can we aim for release in two weeks, or earlier if 7.1.14 becomes available before then? Greg <<<<<SNIP>>> Sawmill XSS Vulnerability [Overview] The web administration page for the Sawmil log analysis software is vulnerable to an XSS attack. The attacker does not need to be authenticated to perform this attack [Vulnerability Details] Sawmill's built in webserver assumes that any query string appended to a GET request is a configuration command. This query string is not validated correctly for HTML tags so an attacker can use <script> tags to alter the output that is displayed to the browser. Possible attacks are varied, and can include creating a false login page to capture authentication details. Example simple attack: http://host/?bla=%3Cscript%3Ealert('XSS');%3C/script%3E [Affected Versions] Version 7.1.13 (and below?) is affected by this vulnerability. The previous version 6.5.11 is not affected by this issue. The latest version 7.1.14 is not affected by this issue. At this time only the windows and the source code (on linux) download versions have been tested. [Solution] Upgrade to version 7.1.14 or newer. [Timeline] The vulnerability was first discovered on 22nd August 2005. Fix availible on 8th September 2005. [References] http://www.nta-monitor.com/news/xss/sawmill/index.htm http://www.sawmill.net Mark Terry Research and Development NTA Monitor Ltd 14 Ashford House, Beaufort Court, Medway City Estate, Rochester, Kent ME2 4FA, UK Email: mark.terry () nta-monitor com WWW: http://www.nta-monitor.com Tel: 01634 721855 Fax: 01634 721844 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Sawmill XSS vuln Mark Terry (Sep 12)