SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Symantec Web Security Vendors:   Symantec
Symantec Web Security Blocked Page Message Lets Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1008711
SecurityTracker URL:  http://securitytracker.com/id/1008711
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Updated:  Jan 15 2004
Original Entry Date:  Jan 14 2004
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2.5, 3.0.0, and 3.0.1
Description:   An input validation vulnerability was reported in Symantec Web Security. A remote user can conduct cross-site scripting attacks.

It is reported that when Symantec Web Security blocks a particular URL, a page displays the blocked URL but does not filter HTML code from the URL. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will run in the security context of the blocked site. As a result, the code may be able to access the target user's cookies (including authentication cookies), if any, associated with unblocked portions of the site, access data recently submitted by the target user via web form to the unblocked portions of the site, or take actions on the unblocked portions of the site acting as the target user.

The vendor credits Oliver.Karow and Brian Soby of Raytheon with separately and independently reporting this vulnerability.

[Editor's note: A similar vulnerability was reported in Norton Internet Security in October 2003, as described in Alert ID 1008010.]

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with a blocked site, access data recently submitted by the target user via web form to the unblocked portions of the site, or take actions on the unblocked portions of the site acting as the target user.
Solution:   Symantec has released a fixed version of Symantec Web Security 3.0.1, build 62.
Vendor URL:  www.sarc.com/avcenter/security/Content/2004.01.13.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  UNIX (Solaris - SunOS), Windows (NT), Windows (2000)

Message History:   None.


 Source Message Contents

Subject:  http://www.sarc.com/avcenter/security/Content/2004.01.13.html


http://www.sarc.com/avcenter/security/Content/2004.01.13.html

 > SYM04-002
 > January 13, 2004
 > Symantec Web Security Cross-Site Scripting Vulnerability

 > Risk Impact
 > Medium

A vulnerability was reported Symantec Web Security.  The software reportedly does not 
properly filter HTML code from URLs before displaying an error page or block page message 
containing the user-supplied URL.

A remote user can conduct cross-site scripting attacks.

Symantec Web Security versions 2.5, 3.0.0, and 3.0.1 are affected, the report said.

Symantec has released a fixed version of Symantec Web Security 3.0.1, build 62.

The vendor credits Oliver.Karow and Brian Soby of Raytheon with separately and 
independently reporting this vulnerability.



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC