SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Webalizer Vendors:   Barrett, Bradford L.
(Engarde Issues Fix) Webalizer Log File Analyzer Cross-Site Scripting Hole Allows Remote Users to Cause Arbitrary But Trusted Code to Be Executed By Another User When Viewing Webalizer Reports
SecurityTracker Alert ID:  1002680
SecurityTracker URL:  http://securitytracker.com/id/1002680
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 1 2001
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.01-06; possibly earlier versions (which were not tested)
Description:   A cross-site scripting vulnerability was reported in The Webalizer, a web server log file analysis package. A remote user could cause scripts to be executed on another user's host in certain situations.

Two vulnerabilities were reported that may allow a remote user to cause scripts to be executed on the browser of a user viewing the HTML reports. The scripts will appear to originate from the Webalizer server. A remote user can inject HTML tags into Webalizer reports such that when another user views the compromised report, the tag will be processed.

It is reported that The Webalizer does not filter data returned by the operating system resolver library when performing a reverse address resolution. A remote user that has control over a DNS reverse address mapping zone can create an address with a PTR record pointing to a name containing HTML tags. Then, the remote user can access a web server that uses Webalizer for log file analysis. When the Webalizer program is subsequently run, the address of the web server access will resolve to a name containing the HTML tags, which will be inserted into the HTML reports without filtering. This exploit is apparently difficult to execute, as most modern resolver libraries apparently refuse to return host names containing HTML meta-characters.

It is reported that a remote user can send an HTTP "Referrer" header containing HTML meta-characters to a web server. When the Webalizer compares the referred URLs to a list of search engine URLs, the keywords used by the apparent search engine are extracted and stored without filtering in the HTML files on the server.

Impact:   A remote user can cause arbitrary scripts to be executed on the browser of a user viewing Webalizer reports. The code will appear to come from the presumably trusted Webalizer reports server. The code may access cookies and other user information.
Solution:   The vendor has released a fix:

EnGarde users can automatically update their system using the Guardian Digital WebTool secure interface.

If choosing to manually upgrade this package, updates can be obtained from:

ftp://ftp.engardelinux.org/pub/engarde/stable/updates/
http://ftp.engardelinux.org/pub/engarde/stable/updates/

Before upgrading the package, the machine must either:

a) be booted into a "standard" kernel; or
b) have LIDS disabled.

To disable LIDS, execute the command:

# /sbin/lidsadm -S -- -LIDS_GLOBAL

To install the updated package, execute the command:

# rpm -Uvh <filename>

You must now update the LIDS configuration by executing the command:

# /usr/sbin/config_lids.pl

To re-enable LIDS (if it was disabled), execute the command:

# /sbin/lidsadm -S -- +LIDS_GLOBAL

To verify the signatures of the updated packages, execute the command:

# rpm -Kv <filename>

The following updated packages are for EnGarde Secure Linux 1.0.1 (Finestra):

Source Packages:

SRPMS/webalizer-2.01-1.0.3.src.rpm
MD5 Sum: 73fd07083ef6d0f6f7981698ac955dae

Binary Packages:

i386/webalizer-2.01-1.0.3.i386.rpm
MD5 Sum: 3d8d8b5169a447565cac5aca1103ecea

i686/webalizer-2.01-1.0.3.i686.rpm
MD5 Sum: b1e2de1411610e6740bbf7e0992aa697

Vendor URL:  www.mrunix.net/webalizer/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  BeOS, Linux (Any), Apple (Legacy "classic" Mac), UNIX (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 25 2001 Webalizer Log File Analyzer Cross-Site Scripting Hole Allows Remote Users to Cause Arbitrary But Trusted Code to Be Executed By Another User When Viewing Webalizer Reports



 Source Message Contents

Subject:  [ESA-20011101-01] webalizer: cross-site scripting vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


+------------------------------------------------------------------------+
| EnGarde Secure Linux Security Advisory               November 01, 2001 |
| http://www.engardelinux.org/                           ESA-20011101-01 |
|                                                                        |
| Package:  webalizer                                                    |
| Summary:  Cross-site scripting vulnerability in webalizer.             |
+------------------------------------------------------------------------+

  EnGarde Secure Linux is a secure distribution of Linux that features
  improved access control, host and network intrusion detection, Web
  based secure remote management, complete e-commerce using AllCommerce,
  and integrated open source security tools.


OVERVIEW
- --------
  There is a cross-site scripting vulnerability in webalizer which can
  allow an attacker to exploit a victim by embedding malicious HTML tags
  in webalizer-generated reports.


DETAIL
- ------
  This update fixes the aforementioned cross-site scripting
  vulnerability reported by Magnux Software.  This updated version also
  fixes a date calculation overflow error and enables DNS resolution
  provided it is enabled in the webalizer configuration file.


SOLUTION
- --------
  All users should upgrade to the most recent version as outlined in
  this advisory.

  Guardian Digital recently made available the Guardian Digital Secure
  Update, a means to proactively keep systems secure and manage 
  system software. EnGarde users can automatically update their system
  using the Guardian Digital WebTool secure interface.

  If choosing to manually upgrade this package, updates can be
  obtained from:

    ftp://ftp.engardelinux.org/pub/engarde/stable/updates/
    http://ftp.engardelinux.org/pub/engarde/stable/updates/

  Before upgrading the package, the machine must either:

    a) be booted into a "standard" kernel; or
    b) have LIDS disabled.

  To disable LIDS, execute the command:

    # /sbin/lidsadm -S -- -LIDS_GLOBAL

  To install the updated package, execute the command:

    # rpm -Uvh <filename>

  You must now update the LIDS configuration by executing the command:

    # /usr/sbin/config_lids.pl

  To re-enable LIDS (if it was disabled), execute the command:

    # /sbin/lidsadm -S -- +LIDS_GLOBAL

  To verify the signatures of the updated packages, execute the command:

    # rpm -Kv <filename>


UPDATED PACKAGES
- ----------------
  These updated packages are for EnGarde Secure Linux 1.0.1 (Finestra).

  Source Packages:

    SRPMS/webalizer-2.01-1.0.3.src.rpm
      MD5 Sum:  73fd07083ef6d0f6f7981698ac955dae

  Binary Packages:

    i386/webalizer-2.01-1.0.3.i386.rpm
      MD5 Sum:  3d8d8b5169a447565cac5aca1103ecea

    i686/webalizer-2.01-1.0.3.i686.rpm
      MD5 Sum:  b1e2de1411610e6740bbf7e0992aa697


REFERENCES
- ----------

  Guardian Digital's public key:
    http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY

  Credit for the discovery of this bug goes to:
    Flavio Veloso <masa@magnux.com>

  Webalizer's Official Web Site:
    http://www.mrunix.net/webalizer/

  Security Contact:    security@guardiandigital.com
  EnGarde Advisories:  http://www.engardelinux.org/advisories.html

- --------------------------------------------------------------------------
$Id: ESA-20011101-01-webalizer 1.2 2001/11/01 18:27:34 rwm Exp $
- --------------------------------------------------------------------------
Author: Ryan W. Maple, <ryan@guardiandigital.com> 
Copyright 2001, Guardian Digital, Inc.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE74ZgnHD5cqd57fu0RAjguAJ9nKnUYrlrOXF9oJq2GBr4tEWvk+wCfe23D
6dqrF8UjjfOXMJVqbZKviy0=
=Twd9
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
     To unsubscribe email engarde-security-request@engardelinux.org
         with "unsubscribe" in the subject of the message.

Copyright(c) 2001 Guardian Digital, Inc.                EnGardeLinux.org
------------------------------------------------------------------------




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC