Re: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

[rvirtue () virtech org]

This issue has been resolved in ALL current Netquery downloads at http://virtech.org/tools/ and, for those who 
downloaded prior to November 11, 2006, a patch is available at the same location.  The following information is from 
the README.txt file included in the patch:
________

This patch for Netquery version 4.0 addresses a potential vulnerability issue originally reported by Zion Security 
(www.zion-security.com) and subsequently by others, including SecurityFocus (www.securityfocus.com) and SecurityTracker 
(www.securitytracker.com).

To install the patch, simply copy both PHP files (nqSniff.class.php and sanitize.inc.php) to the include files 
subfolder of the Netquery module, overwriting the existing nqSniff.class.php file in that subfolder. There is no need 
for any updating of Netquery itself. Nor do any of the module and block items in any of Netquery's CMS editions require 
updating.

Contrary to some of the details contained in the reports cited above, the potential vulnerability affects ALL editions 
of Netquery as they all use the same adaptation of Roger Raymond's client sniffer class. As output from that class has 
no built-in sanitizing feature, this patch addresses the issue by including Gavin Zuchlinski's sanitizer functions.

It should be noted that Roger Raymond's client sniffer is a widely used class. It is used, for example, in various 
functions of several content management systems, including both Postnuke and Xaraya. This patch addresses ONLY those 
potential vulnerabilities associated with Netquery's uses of its output.
________