CVE-2006-3548
CVSS4.3
发布时间 :2006-07-12 20:05:00
修订时间 :2011-03-07 21:38:53
NMCOPS    

[原文]Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).


[CNNVD]Horde Application Framework Services多个跨站脚本攻击漏洞(CNNVD-200607-166)

        Horde Application Framework 3.0.0到3.0.10 和 3.1.0到3.1.1存在多个跨站脚本攻击(XSS) 漏洞。远程攻击者可以借助services/go.php (又称dereferrer)中的url 参数中的 (1) javascript URI或外部(2) http, (3) https,或(4) ftp URI , (5) services/help (又称help viewer)中的module参数的 javascript URI , 以及 (6)services/problem.php (又称problem reporting screen)中的name参数,注入任意Web脚本或HTML 。

- CVSS (基础分值)

CVSS分值: 4.3 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: MEDIUM [漏洞利用存在一定的访问条件]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:horde:horde:3.0.2
cpe:/a:horde:horde:3.0
cpe:/a:horde:horde:3.0.3
cpe:/a:horde:horde:3.0.8
cpe:/a:horde:horde:3.0.7
cpe:/a:horde:horde:3.0.4
cpe:/a:horde:horde:3.1.1
cpe:/a:horde:horde:3.0.4_rc2
cpe:/a:horde:horde:3.0.6
cpe:/a:horde:horde:3.0.4_rc1
cpe:/a:horde:horde:3.1
cpe:/a:horde:horde:3.0.1
cpe:/a:horde:horde:3.0.9

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3548
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3548
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200607-166
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/archive/1/archive/1/439255/100/0/threaded
(VENDOR_ADVISORY)  BUGTRAQ  20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues
http://securitytracker.com/id?1016442
(PATCH)  SECTRACK  1016442
http://moritz-naumann.com/adv/0011/hordemulti/0011.txt
(VENDOR_ADVISORY)  MISC  http://moritz-naumann.com/adv/0011/hordemulti/0011.txt
http://lists.horde.org/archives/announce/2006/000288.html
(PATCH)  CONFIRM  http://lists.horde.org/archives/announce/2006/000288.html
http://lists.horde.org/archives/announce/2006/000287.html
(PATCH)  CONFIRM  http://lists.horde.org/archives/announce/2006/000287.html
http://www.vupen.com/english/advisories/2006/2694
(UNKNOWN)  VUPEN  ADV-2006-2694
http://www.securityfocus.com/bid/18845
(UNKNOWN)  BID  18845
http://xforce.iss.net/xforce/xfdb/27589
(UNKNOWN)  XF  horde-multiple-functions-xss(27589)
http://www.novell.com/linux/security/advisories/2006_19_sr.html
(UNKNOWN)  SUSE  SUSE-SR:2006:019
http://www.debian.org/security/2007/dsa-1406
(UNKNOWN)  DEBIAN  DSA-1406
http://securityreason.com/securityalert/1229
(UNKNOWN)  SREASON  1229
http://secunia.com/advisories/27565
(UNKNOWN)  SECUNIA  27565
http://secunia.com/advisories/21459
(UNKNOWN)  SECUNIA  21459
http://secunia.com/advisories/20954
(UNKNOWN)  SECUNIA  20954
http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html
(UNKNOWN)  FULLDISC  20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues

- 漏洞信息

Horde Application Framework Services多个跨站脚本攻击漏洞
中危 跨站脚本
2006-07-12 00:00:00 2006-07-19 00:00:00
远程  
        Horde Application Framework 3.0.0到3.0.10 和 3.1.0到3.1.1存在多个跨站脚本攻击(XSS) 漏洞。远程攻击者可以借助services/go.php (又称dereferrer)中的url 参数中的 (1) javascript URI或外部(2) http, (3) https,或(4) ftp URI , (5) services/help (又称help viewer)中的module参数的 javascript URI , 以及 (6)services/problem.php (又称problem reporting screen)中的name参数,注入任意Web脚本或HTML 。

- 公告与补丁

        

- 漏洞信息 (F60840)

Debian Linux Security Advisory 1406-1 (PacketStormID:F60840)
2007-11-10 00:00:00
Debian  debian.org
advisory,remote,web,arbitrary,local,vulnerability,xss
linux,debian
CVE-2006-3548,CVE-2006-3549,CVE-2006-4256,CVE-2007-1473,CVE-2007-1474
[点击下载]

Debian Security Advisory 1406-1 - Several remote vulnerabilities have been discovered in the Horde web application framework. Moritz Naumann discovered that Horde allows remote attackers to inject arbitrary web script or HTML in the context of a logged in user (cross site scripting). Moritz Naumann discovered that Horde does not properly restrict its image proxy, allowing remote attackers to use the server as a proxy. Marc Ruef discovered that Horde allows remote attackers to include web pages from other sites, which could be useful for phishing attacks. iDefense discovered that the cleanup cron script in Horde allows local users to delete arbitrary files.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1406-1                    security@debian.org
http://www.debian.org/security/                            Thijs Kinkhorst
November 9th, 2007                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : horde3
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2006-3548 CVE-2006-3549 CVE-2006-4256 CVE-2007-1473 CVE-2007-1474
Debian Bug     : 378281 383416 434045

Several remote vulnerabilities have been discovered in the Horde web
application framework. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2006-3548

    Moritz Naumann discovered that Horde allows remote attackers
    to inject arbitrary web script or HTML in the context of a logged
    in user (cross site scripting).

    This vulnerability applies to oldstable (sarge) only.	    

CVE-2006-3549

    Moritz Naumann discovered that Horde does not properly restrict
    its image proxy, allowing remote attackers to use the server as a
    proxy.

    This vulnerability applies to oldstable (sarge) only.

CVE-2006-4256

    Marc Ruef discovered that Horde allows remote attackers to
    include web pages from other sites, which could be useful for
    phishing attacks.

    This vulnerability applies to oldstable (sarge) only.

CVE-2007-1473

    Moritz Naumann discovered that Horde allows remote attackers
    to inject arbitrary web script or HTML in the context of a logged
    in user (cross site scripting).

    This vulnerability applies to both stable (etch) and oldstable (sarge).

CVE-2007-1474

    iDefense discovered that the cleanup cron script in Horde
    allows local users to delete arbitrary files.

    This vulnerability applies to oldstable (sarge) only.


For the old stable distribution (sarge) these problems have been fixed in
version 3.0.4-4sarge6.

For the stable distribution (etch) these problems have been fixed in
version 3.1.3-4etch1.

For the unstable distribution (sid) these problems have been fixed in
version 3.1.4-1.

We recommend that you upgrade your horde3 package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sarge6.dsc
      Size/MD5 checksum:      920 a829a3791ed40777b0a4995be6727f13
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sarge6.diff.gz
      Size/MD5 checksum:    13978 ab0dc18c4744b21919c154ac81600ad7
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4.orig.tar.gz
      Size/MD5 checksum:  3378143 e2221d409ba1c8841ce4ecee981d7b61

  Architecture independent components:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sarge6_all.deb
      Size/MD5 checksum:  3437942 f2cd9a0c7cb7e800d357d206d9f19841


Debian GNU/Linux 4.0 alias etch
- -------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch1.dsc
      Size/MD5 checksum:      974 9fe3ec9d81a0d0c8ec6dd2ae3e14ed40
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch1.diff.gz
      Size/MD5 checksum:    10633 84cad3aed2026c8a6358891897a15ee7
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3.orig.tar.gz
      Size/MD5 checksum:  5232958 fbc56c608ac81474b846b1b4b7bb5ee7

  Architecture independent components:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch1_all.deb
      Size/MD5 checksum:  5270226 34a3af59a3469722ecf832948d390cea

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHNOM0Xm3vHE4uyloRAhqCAKDW38OVpHkAYAfr9LNzvh5k/j+8fQCg29kw
KknLxPttFWUKWRsaCB5PesA=
=SoAf
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
    

- 漏洞信息

27033
Horde services/help/index.php module Parameter XSS
Remote / Network Access Input Manipulation
Loss of Integrity

- 漏洞描述

Unknown or Incomplete

- 时间线

2006-07-05 Unknow
2006-07-05 Unknow

- 解决方案

Upgrade to version 3.0.11, 3.1.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Horde Application Framework Services Multiple Cross-Site Scripting Vulnerabilities
Input Validation Error 18845
Yes No
2006-07-05 12:00:00 2007-11-15 12:36:00
Moritz Naumann is credited with the discovery of these vulnerabilities.

- 受影响的程序版本

SuSE SUSE Linux Enterprise Server 8
+ Linux kernel 2.4.21
+ Linux kernel 2.4.19
SuSE SUSE Linux Enterprise Server 10
SuSE SUSE Linux Enterprise Desktop 10
S.u.S.E. UnitedLinux 1.0
S.u.S.E. SuSE Linux Standard Server 8.0
S.u.S.E. SuSE Linux School Server for i386
S.u.S.E. SUSE LINUX Retail Solution 8.0
S.u.S.E. Open-Enterprise-Server 9.0
S.u.S.E. Open-Enterprise-Server 1
S.u.S.E. Office Server
S.u.S.E. Novell Linux Desktop 9.0
S.u.S.E. Novell Linux Desktop 1.0
S.u.S.E. Linux Professional 10.0 OSS
S.u.S.E. Linux Professional 10.0
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Professional 9.1 x86_64
S.u.S.E. Linux Professional 9.1
S.u.S.E. Linux Professional 10.1
S.u.S.E. Linux Personal 10.0 OSS
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1 x86_64
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 10.1
S.u.S.E. Linux Openexchange Server
S.u.S.E. Linux Office Server
S.u.S.E. Linux Enterprise Server for S/390 9.0
S.u.S.E. Linux Enterprise Server for S/390
S.u.S.E. Linux Enterprise Server 9
S.u.S.E. Linux Database Server 0
S.u.S.E. Linux Connectivity Server
Horde Project Horde 3.1.1
Horde Project Horde 3.0.9
Horde Project Horde 3.0.8
Horde Project Horde 3.0.7
Horde Project Horde 3.0.6
Horde Project Horde 3.0.4 -RC 2
Horde Project Horde 3.0.4 -RC 1
Horde Project Horde 3.0.4
Horde Project Horde 3.0.3
Horde Project Horde 3.0.2
Horde Project Horde 3.0.1
Horde Project Horde 3.0
Horde Project Horde 3.1
Debian Linux 3.1 sparc
Debian Linux 3.1 s/390
Debian Linux 3.1 ppc
Debian Linux 3.1 mipsel
Debian Linux 3.1 mips
Debian Linux 3.1 m68k
Debian Linux 3.1 ia-64
Debian Linux 3.1 ia-32
Debian Linux 3.1 hppa
Debian Linux 3.1 arm
Debian Linux 3.1 amd64
Debian Linux 3.1 alpha
Debian Linux 3.1
Debian Linux 4.0 sparc
Debian Linux 4.0 s/390
Debian Linux 4.0 powerpc
Debian Linux 4.0 mipsel
Debian Linux 4.0 mips
Debian Linux 4.0 m68k
Debian Linux 4.0 ia-64
Debian Linux 4.0 ia-32
Debian Linux 4.0 hppa
Debian Linux 4.0 arm
Debian Linux 4.0 amd64
Debian Linux 4.0 alpha
Debian Linux 4.0
Horde Project Horde 3.1.2
Horde Project Horde 3.0.11

- 不受影响的程序版本

Horde Project Horde 3.1.2
Horde Project Horde 3.0.11

- 漏洞讨论

Horde is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

- 漏洞利用

Attackers can exploit these issues by enticing a victim to follow a malicious link that includes hostile HTML and script code.

- 解决方案

The vendor has released software updates to address these issues; please see the references for details.

mailto:vuldb@securityfocus.com

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站