From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Aug 20 2008 - 14:24:05 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Vanilla Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31527

VERIFY ADVISORY:
http://secunia.com/advisories/31527/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
From remote

SOFTWARE:
Vanilla 1.x
http://secunia.com/product/16237/

DESCRIPTION:
Some vulnerabilities have been reported in Vanilla, which can be
exploited by malicious users to conduct script insertion attacks, and
by malicious people to conduct cross-site scripting and cross-site
request forgery attacks.

1) Input passed to the "NewPassword" parameter in people.php (when
"PostBackAction" is set to "Apply") is not properly sanitised before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

2) Input passed to the "Account picture", "Icon", and "Value" (under
"Add custom information") form fields in account.php is not properly
sanitised before being stored. This can be exploited to insert
arbitrary HTML attributes, which are executed in a user's browser
session in context of an affected site when the malicious data is
viewed.

Successful exploitation of this vulnerability requires that the
attacker has valid user credentials and that the victim has valid
administrator credentials.

3) A vulnerability in ajax/UpdateCheck.php is caused due to the
application allowing users to perform certain actions via HTTP
requests without performing any validity checks to verify the
request. No further information is currently available.

4) A vulnerability in the sign-out functionality is caused due to the
application allowing users to perform certain actions via HTTP
requests without performing any validity checks to verify the
request. No further information is currently available.

The vulnerabilities are reported in version 1.1.4. Other versions may
also be affected.

SOLUTION:
All vulnerabilities except for the "Value" form field in #2 are fixed
in version 1.1.5-rc1.

Edit the source code to ensure that input is properly sanitised. Do
not browse untrusted web sites while logged on to the application.

PROVIDED AND/OR DISCOVERED BY:
1, 2) James Bercegay, GulfTech Security Research Team
3) Dinoboff
4) ggaudrea

ORIGINAL ADVISORY:
Vanilla:
http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1/

GulfTech:
http://www.gulftech.org/?node=research&article_id=00126-08192008

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]