SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   MIMEsweeper Vendors:   Clearswift Limited
MIMEsweeper for Web Input Validation Hole in 'Access Denied' Page Permits Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1016454
SecurityTracker URL:  http://securitytracker.com/id/1016454
CVE Reference:   CVE-2006-3522   (Links to External Site)
Updated:  Jul 18 2008
Original Entry Date:  Jul 10 2006
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 5.1.5
Description:   A vulnerability was reported in MIMEsweeper for Web. A remote user can conduct cross-site scripting attacks.

The system does not properly filter HTML code from user-supplied input before displaying the 'access denied' error page. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the MIMEsweeper for Web software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit URL is provided:

http://[SomeBlackListedSite]/<script>PAYLOAD</script>

The vendor was notified on June 27, 2006.

Erez Metula discovered this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the MIMEsweeper software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has issued a fix ("MIMEsweeper for Web 5.1.15 Hotfix"), available at:

http://www.clearswift.com/support/msw/patch_MswWeb.aspx

Vendor URL:  www.clearswift.com/products/msw/msw_web/default.aspx (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (2000), Windows (2003)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] MIMESweeper For Web 5.X Cross Site Scripting

This is a multi-part message in MIME format.

--===============1445776972==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C6A369.3FE6BA2F"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6A369.3FE6BA2F
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

=20

MIMESweeper For Web 5.X Cross Site Scripting

=20

=20

I. INTRODUCTION

=20

MIMESweeper For Web is a policy-based content security for web
applications. It analyzes web content and blocks pages or files that are
prohibited by the organizational security policy.

=20

For more Information please refer to:

http://www.clearswift.com/products/msw/msw_web/default.aspx

=20

=20

II. DESCRIPTION

=20

A XSS vulnerability was discovered by Erez Metula. When accessing a URL
which is not permitted the user is redirected to an "access denied" page
that is vulnerable to XSS. The page does not input validate / HTML
Encode the input and displays the data "as is".

=20

Usually this means that it enables an attacker to inject HTML or
Javascript code into users's browsers, and by that bypassing the browser
DOM restrictions.

This javascript code can perform actions on behalf of the user, steal
authentication cookies, change the appearance of web pages, perform
phishing ,and generally can do everything to the original page.

=20

=20

III. EXPLOITATION

=20

The vulnerability can be exploited by just redirecting the client to
some URL that is restricted by MIMESweeper policy and adding the script
at the end of the URL.

=20

Example PoC:

http://SomeBlackListedSite/<script>PAYLOAD</script
<http://someblacklistedsite/%3cscript%3ePAYLOAD%3c/script> >

=20

=20

IV. IMPACT

=20

Using the MIMESweeper capabilities of a central gateway to spread
malicious scripts to users.

An example attack scenario could be that an attacker will redirect many
users (by email, posting in the organization portal, etc.) to some
blocked URL and an accompanying script that will steal their
authentication cookies.

=20

V. DETECTION

=20

Detection of this vulnerability involves injecting some HTML tags /
scripts to a blocked URL that will be responded by the MIMESweeper with
the vulnerable page.

=20

VI. WORKAROUND

=20

Clearswift released a patch for this vulnerability, following the
initial contact &notification.

The patch can be obtained from:

http://www.clearswift.com/support/msw/patch_MswWeb.aspx

termed as "MIMEsweeper for Web 5.1.15 Hotfix"

=20

=20

VII. VENDOR RESPONSE

=20

Clearswift has been informed on the 27/6/06 by e-mail to their support.

Clearswift released a fixed version of the software.

=20

=20

VIII. DISCLOSURE TIMELINE

=20

27/06/06            Identification of the flaw

27/06/06            Reporting the flaw to clearswift by email

27/06/06            Response from clearswift, asking for more
description

27/06/06            Providing the full description to clearswift

28/06/06            Clearswift acknowledge of the vulnerability

06/07/06            Patch released by clearswift

09/07/06            Public advisory

=20

=20

IX. CREDITS

=20

The vulnerability was discovered by Erez Metula.

=20

Erez Metula, CISSP   =20
Application Security Department Manager

Security Software Engineer

E-Mail:  erezmetula@2bsecure.co.il <mailto:erezmetula@2bsecure.co.il>=20

=20

=20

=20


------_=_NextPart_001_01C6A369.3FE6BA2F
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	text-align:right;
	direction:rtl;
	unicode-bidi:embed;
	font-size:12.0pt;
	font-family:"Times New Roman";}
a:link, span.MsoHyperlink
	{color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:Arial;
	color:windowtext;}
@page Section1
	{size:595.3pt 841.9pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
	{page:Section1;}
-->
</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1 dir=3DRTL>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>MIMESweeper For Web 5.X =
Cross Site
Scripting<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>I. =
INTRODUCTION<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>MIMESweeper For Web is a =
policy-based
content security for web applications. It analyzes web content and =
blocks pages
or files that are prohibited by the organizational security =
policy.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>For more Information please =
refer to:<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><a
href=3D"http://www.clearswift.com/products/msw/msw_web/default.aspx">http=
://www.clearswift.com/products/msw/msw_web/default.aspx</a><o:p></o:p></s=
pan></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>II. =
DESCRIPTION<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>A XSS vulnerability was =
discovered
by Erez Metula. When accessing a URL which is not permitted the user is
redirected to an &quot;access denied&quot; page that is vulnerable to =
XSS. The page
does not input validate / HTML Encode the input and displays the data =
&quot;as
is&quot;.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Usually
this means that it enables an attacker to inject HTML or Javascript code =
into
users's browsers, and by that bypassing the browser DOM =
restrictions.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>This
javascript code can perform actions on behalf of the user, steal =
authentication
cookies, change the appearance of web pages, perform phishing ,and =
generally
can do everything to the original page.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>&nbsp;<o:p></o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>III. =
EXPLOITATION<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>The
vulnerability can be exploited by just redirecting the client to some =
URL that
is restricted by MIMESweeper policy and adding the script at the end of =
the
URL.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Example
PoC:<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><a
href=3D"http://someblacklistedsite/%3cscript%3ePAYLOAD%3c/script">http://=
SomeBlackListedSite/&lt;script&gt;PAYLOAD&lt;/script</a>&gt;<o:p></o:p></=
span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'margin-left:36.0pt;text-align:left;
direction:ltr;unicode-bidi:embed'><font size=3D3 face=3D"Times New =
Roman"><span
style=3D'font-size:12.0pt'>&nbsp;</span></font><font size=3D2 =
face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p=
>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>IV. =
IMPACT<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>Using the MIMESweeper =
capabilities
of a central gateway to spread malicious scripts to =
users.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>An example attack scenario =
could be
that an attacker will redirect many users (by email, posting in the
organization portal, etc.) to some blocked URL and an accompanying =
script that
will steal their authentication cookies.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>V. =
DETECTION<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>Detection of this =
vulnerability involves
injecting some HTML tags / scripts to a blocked URL that will be =
responded by
the MIMESweeper with the vulnerable page.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>VI. =
WORKAROUND<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>Clearswift released a patch =
for this
vulnerability, following the initial contact =
&amp;notification.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>The patch can be obtained =
from:<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><a
href=3D"http://www.clearswift.com/support/msw/patch_MswWeb.aspx">http://w=
ww.clearswift.com/support/msw/patch_MswWeb.aspx</a><o:p></o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>termed as &quot;<b><span
style=3D'font-weight:bold'>MIMEsweeper for Web 5.1.15 =
Hotfix</span>&quot;</span></b><o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>VII. VENDOR =
RESPONSE<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>Clearswift has been =
informed on the 27/6/06
by e-mail to their support.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>Clearswift released a fixed =
version
of the software.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span =
lang=3DPT-BR
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>VIII. DISCLOSURE =
TIMELINE<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;line-height:150%;text-autospace:
none;direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;line-height:150%;font-family:Arial'>27/06/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Identification
of the flaw<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;line-height:150%;text-autospace:
none;direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;line-height:150%;font-family:Arial'>27/06/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Reporting
the flaw to clearswift by email<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;line-height:150%;text-autospace:
none;direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;line-height:150%;font-family:Arial'>27/06/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Response
from clearswift, asking for more =
description<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;line-height:150%;text-autospace:
none;direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;line-height:150%;font-family:Arial'>27/06/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Providing
the full description to clearswift<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;line-height:150%;text-autospace:
none;direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;line-height:150%;font-family:Arial'>28/06/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Clearswift
acknowledge of the vulnerability<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;line-height:150%;text-autospace:
none;direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;line-height:150%;font-family:Arial'>06/07/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Patch
released by clearswift<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>09/07/06 =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Public
advisory<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>IX. =
CREDITS<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'>The vulnerability was =
discovered by Erez
Metula.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;text-autospace:none;
direction:ltr;unicode-bidi:embed'><font size=3D2 face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Erez
Metula, CISSP&nbsp;&nbsp;&nbsp; <br>
Application Security Department Manager<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Security&nbsp;Software
Engineer<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span lang=3DPT-BR =
style=3D'font-size:10.0pt;
font-family:Arial'>E-Mail:&nbsp;</span></font><font size=3D2 =
face=3DArial><span
lang=3DPT-BR style=3D'font-size:10.0pt;font-family:Arial'> =
</span></font><font
size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><a
href=3D"mailto:erezmetula@2bsecure.co.il"><font color=3Dblack><span
style=3D'color:windowtext;text-decoration:none'>erezmetula@2bsecure.co.il=
</span></font></a><o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span lang=3DPT-BR =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></fo=
nt></p>

<p class=3DMsoNormal dir=3DRTL><font size=3D3 face=3D"Times New =
Roman"><span lang=3DHE
style=3D'font-size:12.0pt'><o:p>&nbsp;</o:p></span></font></p>

</div>

</body>

</html>

------_=_NextPart_001_01C6A369.3FE6BA2F--


--===============1445776972==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============1445776972==--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC