NI3
11-05-2003, 02:09 PM
TITLE:
MLdonkey Admin Access and Cross Site Scripting Vulnerability
SECUNIA ADVISORY ID:
SA10134
VERIFY ADVISORY:
[Only registered and activated users can see links]
CRITICAL:
Not critical
IMPACT:
Security Bypass, Cross Site Scripting
WHERE:
From remote
SOFTWARE:
MLdonkey 2.x
DESCRIPTION:
Two vulnerabilities have been identified in MLdonkey allowing
malicious HTML documents such as emails and web pages to access the
admin interface and conduct Cross Site Scripting.
The problem is that there isn't any verification of the origin of the
request and that certain input isn't properly verified allowing Cross
Site Scripting.
A request for the following URL will open the admin interface for
access by any IP:
[Only registered and activated users can see links]
SOLUTION:
****** HTML documents with references to local resources such as
"localhost" and "127.0.0.1" using a ***** server.
REPORTED BY / CREDITS:
Chris Sharp
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
[Only registered and activated users can see links]
Definitions: (Criticality, Where etc.)
[Only registered and activated users can see links]
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
MLdonkey Admin Access and Cross Site Scripting Vulnerability
SECUNIA ADVISORY ID:
SA10134
VERIFY ADVISORY:
[Only registered and activated users can see links]
CRITICAL:
Not critical
IMPACT:
Security Bypass, Cross Site Scripting
WHERE:
From remote
SOFTWARE:
MLdonkey 2.x
DESCRIPTION:
Two vulnerabilities have been identified in MLdonkey allowing
malicious HTML documents such as emails and web pages to access the
admin interface and conduct Cross Site Scripting.
The problem is that there isn't any verification of the origin of the
request and that certain input isn't properly verified allowing Cross
Site Scripting.
A request for the following URL will open the admin interface for
access by any IP:
[Only registered and activated users can see links]
SOLUTION:
****** HTML documents with references to local resources such as
"localhost" and "127.0.0.1" using a ***** server.
REPORTED BY / CREDITS:
Chris Sharp
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
[Only registered and activated users can see links]
Definitions: (Criticality, Where etc.)
[Only registered and activated users can see links]
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.