iDefense Security Advisory 07.19.07: Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability

Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability iDefense Security Advisory 07.19.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 19, 2007 I. BACKGROUND Microsoft Internet Explorer and Mozilla Firefox are the two most popular web browsers. Many people have...

Cross site scripting

Cross-site scripting XSS vulnerability in takeprofedit.php in TBDev.NET DR 010306 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the avatar parameter. NOTE: this may be related to the tracker program in the Janitor package. NOTE: the provenance...

CVE-2007-3833

The AOL Instant Messenger AIM protocol handler in Cerulean Studios Trillian allows remote attackers to create files with arbitrary contents via certain aim: URIs, as demonstrated by a URI that begins with the "aim: &c:" substring and contains a full pathname in the ini field. NOTE: this can be...

CVE-2007-3832

The CVE-2007-3832 issue affects Trillian before 3.1.7.0, where a buffer overflow in the AIM protocol URI handler (aim.dll) can be triggered by specially crafted aim:// URIs. An unauthenticated remote attacker could potentially execute arbitrary code with the user’s privileges by convincing a user...

CVE-2007-3832

Buffer overflow in the AOL Instant Messenger AIM protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execute arbitrary code via a malformed aim: URI, as demonstrated by a long URI beginning with the aim:///1111111/ substring...

Code injection

konqueror/konqcombo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

CVE-2007-3820

konqueror/konqcombo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

Design/Logic Flaw

Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

CVE-2007-3819

Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

CVE-2007-3820

konqueror/konqcombo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

CVE-2007-3819

Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

CVE-2007-3819

Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

CVE-2007-3819

Opera 9.21 is affected by CVE-2007-3819: a vulnerability that lets remote attackers spoof the data: URI scheme in the address bar by providing a long URI with trailing whitespace, which prevents the initial part of the URI from being displayed. This can enable spoofing of the targeted site in the...

CVE-2007-3820

CVE-2007-3820 affects Konqueror (Konqueror 3.5.7) via konq_combo.cc: remote attacker can spoof the data: URI in the address bar by sending a long URI with trailing whitespace, causing the start of the URI to be hidden. This is a Konqueror/address-bar spoofing flaw. Public advisories exist (e.g., ...

CVE-2007-3820

konqueror/konqcombo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed...

Trillian 3.1.6.0 - URI Handler Remote Code Execution

source: https://www.securityfocus.com/bid/24927/info Trillian is prone to remote command- and code-execution vulnerabilities because the application fails to properly handle user-supplied input via a registered URI. Successfully exploiting these issues allows attackers to execute arbitrary comman...

Trillian 3.1.6.0 - URI Handler Remote Code Execution

Trillian 3.1.6.0 - URI Handler Remote Code Execution source: https://www.securityfocus.com/bid/24927/info Trillian is prone to remote command- and code-execution vulnerabilities because the application fails to properly handle user-supplied input via a registered URI. Successfully exploiting thes...

EVisit Analyst ID参数SQL注入漏洞

BUGTRAQ ID: 24849 CNCAN ID:CNCAN-2007071101 EVisit Analyst是一款基于PHP的WEB应用程序。 EVisit Analyst不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 Maxsi eVisit Analyst 目前没有解决方案提供： http://www.evisitanalyst.com/...

Directory traversal

Directory traversal vulnerability in Ada Image Server ImgSvr 0.6.5 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE...

Mozilla Firefox WYCIWYG:// URI绕过缓存区限制漏洞

BUGTRAQ ID: 24831 Mozilla Firefox是一款非常流行的开源WEB浏览器。 Firefox实现的wyciwyg://伪URI资源类型的访问控制存在漏洞，远程攻击者可能利用此漏洞获取Web浏览器相关的敏感信息。 wyciwyg://伪URI资源类型用于整理和引用本地所缓存的页面，但wyciwyg:// URI的访问控制并不充分，用户可通过XMLHttpRequest或IFRAMEd view-source:访问所缓存的文档。尽管仍正确地实现同域策略，但恶意站点可以绕过cookie设置向用户计算机存储任意标记；如果结合HTTP...