Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Sawmill Input Validation Error in Web Administration Interface Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1014885 |
|
SecurityTracker URL: http://securitytracker.com/id/1014885
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 12 2005
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.0.0 through 7.1.13
|
Description:
A vulnerability was reported in Sawmill. A remote user can conduct cross-site scripting attacks.
The web administration interface for the Sawmil does not properly filter HTML code from user-supplied GET requests before displaying incorrect input as part of an error message. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Sawmill software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit URL is provided:
http://[target]/?bla=%3Cscript%3Ealert('XSS');%3C/script%3E
The vendor was notified on August 22, 2005.
Mark Terry of NTA Monitor reported this vulnerability.
The original advisory is available at:
http://www.nta-monitor.com/news/xss/sawmill/index.htm
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Sawmill software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
The vendor has issued a fixed version (7.1.14), available at:
http://www.sawmill.net/us_downloads.html
|
Vendor URL: www.sawmill.net/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 12 Sep 2005 15:57:50 +0100
Subject: Sawmill XSS vuln
|
Bugtraq,
This has been delayed until the vendor had released a new version:
<<<<SNIP>>>>>
Date: Fri, 26 Aug 2005 11:48:48 -0700
From: Greg Ferrar <ferrar@flowerfire.com>
User-Agent: Mozilla Thunderbird 1.0.2 (Macintosh/20050317)
X-Accept-Language: en-us, en
To: Terence.Wong@nta-monitor.com
Cc: support@sawmill.co.uk
Subject: Re: FW: XSS vulnerability
X-Scanned-By: MIMEDefang 2.48 on 192.168.124.1
Terence,
Thank you for reporting this vulerability in Sawmill. We have researched
this, and verified this vulnerability. This vulnerability exists in
Sawmill version 7.0.0 through 7.1.13. All platforms, including Windows,
are vulerable to this attack.
We have fixed this in the latest internal version, by replacing < and
< and > with >, and & with &, in the error message. You can
get a pre-release with the fix from http://sawmill.net/prerelease.html .
We plan to ship Sawmill 7.1.14 next week, probably next Friday. It is
possible it will be delayed by as much as a week. So as a tentative
timeline, can we aim for release in two weeks, or earlier if 7.1.14
becomes available before then?
Greg
<<<<<SNIP>>>
Sawmill XSS Vulnerability
[Overview]
The web administration page for the Sawmil log analysis software is
vulnerable to an XSS attack. The attacker does not need to be
authenticated to perform this attack
[Vulnerability Details]
Sawmill's built in webserver assumes that any query string appended to a
GET request is a configuration command. This query string is not
validated correctly for HTML tags so an attacker can use <script> tags
to alter the output that is displayed to the browser.
Possible attacks are varied, and can include creating a false login page
to capture authentication details.
Example simple attack:
http://host/?bla=%3Cscript%3Ealert('XSS');%3C/script%3E
[Affected Versions]
Version 7.1.13 (and below?) is affected by this vulnerability.
The previous version 6.5.11 is not affected by this issue. The latest
version 7.1.14 is not affected by this issue.
At this time only the windows and the source code (on linux) download
versions have been tested.
[Solution]
Upgrade to version 7.1.14 or newer.
[Timeline]
The vulnerability was first discovered on 22nd August 2005. Fix
availible on 8th September 2005.
[References]
http://www.nta-monitor.com/news/xss/sawmill/index.htm
http://www.sawmill.net
Mark Terry
Research and Development
NTA Monitor Ltd
14 Ashford House,
Beaufort Court,
Medway City Estate,
Rochester,
Kent ME2 4FA, UK
Email: mark.terry@nta-monitor.com
WWW: http://www.nta-monitor.com
Tel: 01634 721855
Fax: 01634 721844
|
|
Go to the Top of This SecurityTracker Archive Page
|
