tripwire-xss.txt

`Name: Tripwire Enterprise/Server XSS Vulnerability  
Release Date: 29 January 2008  
Reference: LSD001-2008  
Discover: Dave Lewis  
Vendor: Tripwire  
Product: Tripwire Enterprise/Server Management Web Interface  
Systems Affected: version 7.0 (as tested)  
NB. Earlier versions are affected as well. Please upgrade.  
  
  
Risk: Less Critical  
Status: Published  
Reference:  
<a  
href="http://www.liquidmatrix.org/blog/2007/12/10/advisory-tripwire-enterprise-xss-vulnerability/">http://www.liquidmatrix.org/blog/2007/12/10/advisory-tripwire...ility/</a>  
  
Description  
  
The Tripwire Enterprise/Server management login page contains a  
vulnerability in the login page is susceptible to a cross site scripting  
(XSS) attack.  
  
Impact: a remote attacker could execute a XSS attack that could pass  
arbitrary html to the user.  
  
Technical Details  
  
Input passed to the URL of the web management login page is not properly  
sanitized before being returned to the user. This can be exploited to  
execute arbitrary HTML and script code in a user's browser session in  
context of an affected site.  
  
Fix Information  
  
This issue has been resolved.  
  
The patch may be obtained by customers from:  
  
http://www.tripwire.com (Patch 866 "te-7.0.0.866_patch.zip")  
  
  
<b>Liquidmatrix Security Digest</b>  
http://www.liquidmatrix.org/blog/  
  
2255B Queen Street East  
suite 156  
Toronto, Ontario  
Canada  
M4E 1G3  
`