SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   w3m Vendors:   Ito, Akinori
w3m Text Web Browser Input Validation Flaw Allows Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1006060
SecurityTracker URL:  http://securitytracker.com/id/1006060
CVE Reference:   CVE-2002-1335, CVE-2002-1348   (Links to External Site)
Updated:  Dec 8 2003
Original Entry Date:  Feb 7 2003
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 0.3.2.2
Description:   An input validation vulnerability was reported in the w3m web browser. A remote user can conduct cross-site scripting attacks.

It is reported that the browser does not filter HTML code from the HTML IMG tag's ALT attribute. The flaw resides in the html_quote() function in 'file.c'.

It is also reported that versions of the browser prior to 0.3.2 do not properly filter HTML code in frames.

A remote user can create HTML that, when loaded by the browser, will cause arbitrary scripting code to be executed by the target user's browser. The code will run in the security context of the browser itself. As a result, the code will be able to access the target user's cookies (including authentication cookies), local files, and other information.

The vendor credits Hironori SAKAMOTO with discovering the flaw.

Impact:   A remote user can access the target user's cookies (including authentication cookies) and local files.
Solution:   The vendor has released a fixed version (0.3.2.2), available at:

http://sourceforge.net/projects/w3m/
http://sourceforge.net/project/showfiles.php?group_id=39518&release_id=126233

Vendor URL:  sourceforge.net/project/shownotes.php?group_id=39518&release_id=126233 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
(Red Hat Issues Fix) Re: w3m Text Web Browser Input Validation Flaw Allows Cross-Site Scripting Attacks
Red Hat has issued a fix.
(Debian Issues Fix) w3m Text Web Browser Input Validation Flaw Allows Cross-Site Scripting Attacks
Debian has released a fix.
(Debian Issues Fix for SSL Version) w3m Text Web Browser Input Validation Flaw Allows Cross-Site Scripting Attacks
The vendor has released a fix for the w3mmee-ssl package.



 Source Message Contents

Subject:  w3m fix


http://sourceforge.net/project/shownotes.php?group_id=39518&release_id=126233

Release Name: w3m-0.3.2.2

Notes:
w3m 0.3.2.2 is stable update of w3m 0.3.2.
Hironori SAKAMOTO  found another security 
vulnerability in w3m 0.3.2.x that w3m will miss to escape html tag 
in img alt attribute, so malicious frame html may deceive you to 
access your local files, cookies and so on.



Changes:
* file.c (process_img): html_quote()
	(loadHTMLstream): HTMLlineproc0 internal


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC