w3m Text Web Browser Input Validation Flaw Allows Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1006060 |
|
SecurityTracker URL: http://securitytracker.com/id/1006060
|
|
CVE Reference:
CAN-2002-1335, CAN-2002-1348
(Links to External Site)
|
Updated: Dec 8 2003
|
Original Entry Date: Feb 7 2003
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 0.3.2.2
|
Description:
An input validation vulnerability was reported in the w3m web browser. A remote user can conduct cross-site scripting attacks.
It is reported that the browser does not filter HTML code from the HTML IMG tag's ALT attribute. The flaw resides in the html_quote() function in 'file.c'.
It is also reported that versions of the browser prior to 0.3.2 do not properly filter HTML code in frames.
A remote user can create HTML that, when loaded by the browser, will cause arbitrary scripting code to be executed by the target user's browser. The code will run in the security context of the browser itself. As a result, the code will be able to access the target user's cookies (including authentication cookies), local files, and other information.
The vendor credits Hironori SAKAMOTO with discovering the flaw.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies) and local files.
|
Solution:
The vendor has released a fixed version (0.3.2.2), available at:
http://sourceforge.net/projects/w3m/
http://sourceforge.net/project/showfiles.php?group_id=39518&release_id=126233
|
Vendor URL: sourceforge.net/project/shownotes.php?group_id=39518&release_id=126233 (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Fri, 07 Feb 2003 03:13:28 -0500
Subject: w3m fix
|
http://sourceforge.net/project/shownotes.php?group_id=39518&release_id=126233
Release Name: w3m-0.3.2.2
Notes:
w3m 0.3.2.2 is stable update of w3m 0.3.2.
Hironori SAKAMOTO found another security
vulnerability in w3m 0.3.2.x that w3m will miss to escape html tag
in img alt attribute, so malicious frame html may deceive you to
access your local files, cookies and so on.
Changes:
* file.c (process_img): html_quote()
(loadHTMLstream): HTMLlineproc0 internal
|
|
