SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Macromedia JRun Vendors:   Macromedia
Macromedia JRun Input Validation Flaws in Administrative Interface Permit Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1008300
SecurityTracker URL:  http://securitytracker.com/id/1008300
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 26 2003
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network

Version(s): 4 (build 61650)
Description:   An input validation vulnerability was reported in Macromedia's JRun administrative interface. A remote user can conduct cross-site scripting attacks against JRun administrators to steal their authentication cookies and access the system.

dr_insane reported that serveral scripts fail to filter HTML scripting code from user-supplied input before displaying information based on the user-supplied input. A remote user can create a specially crafted URL that, when loaded by a target administrator, will cause arbitrary scripting code to be executed by the target administrator's browser. The code will originate from the site running the vulnerable software and will run in the security context of that site. As a result, the code will be able to access the target administrator's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target administrator via web form to the site, or take actions on the site acting as the target administrator.

Several demonstration exploit URLs are provided:

http://[server]:8000/server/[your_server]/webserver/webserverlist.jsp?action=start&externalWebServer=DefaultDomain%3aservice%3d[Javascript
code]

http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]

http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]&tabs=settings

http://[server]:8000/server/[your_server]/webserver/jrunwebserverconfig.jsp?webServerId=DefaultDomain%3aservice%3dWebService&isSSL=FALSE

http://[server]:8000/server/[your_server]/serverframe.jsp?tabs=settings&subtabs=jvmsettings

Impact:   A remote user can access the target administrator's cookies (including authentication cookies), if any, associated with the site running the vulnerable software, access data recently submitted by the target administrator via web form to the site, or take actions on the site acting as the target administrator.
Solution:   No solution was available at the time of this entry.

The author of the report indicated that, as a workaround, you can disable the remote administrative interface.

Vendor URL:  www.macromedia.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Red Hat Linux), Linux (SuSE), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [0day] dr_insane||Macromedia Jrun 4 (build 61650) web server remote


-
----------------------------------------------------------------------------------
Macromedia Jrun 4 (build 61650) web server remote administration CSS vulnerabilities
-----------------------------------------------------------------------------------


13/11/2003 (Revision 1)

Local:
------
Yes

Remote:
-------
yes

-------------------
Vendor Information:
-------------------
http://www.macromedia.com


--------------------------
Affected  Versions/systems:
--------------------------
Solaris 7,8,9 
Red Hat Linux 6.2, 7.x 
SuSE Linux 7.3, 8.0 
HP-UX 11i 
IBM AIX 4.3, 5.x 
Compaq Tru64 5.1 UNIX
Windows 98/ME/NT/2000/XP 



-------------------
Description:
-------------------
I encountered some XSS security holes in Macromedia 4 (build 61650).  it is possible
to steal cookies using these bugs and compromise the whole system.


-------------------
Exploit:
-------------------


http://[server]:8000/server/[your_server]/webserver/webserverlist.jsp?action=start&externalWebServer=DefaultDomain%3aservice%3d[Javascript
 code]

http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]

http://[server]:8000/clusterframe.jsp?cluster=[Javascript_code]&tabs=settings

http://[server]:8000/server/[your_server]/webserver/jrunwebserverconfig.jsp?webServerId=DefaultDomain%3aservice%3dWebService&isSSL=FALSE

http://[server]:8000/server/[your_server]/serverframe.jsp?tabs=settings&subtabs=jvmsettings


-----------------
| SoLuTiOn |
-----------------
Disable the remote administration service.


-----------
| CONTACT |
-----------
dr_insane (dr_insane@pathfinder.gr)
http://members.lycos.co.uk/r34ct/

______________________________________________________________________________________
http://mobile.pathfinder.gr - Pathfinder Mobile logos & Ringtones! 

_______________________________________________
0day mailing list
0day@nothackers.org
http://nothackers.org/mailman/listinfo/0day

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC