Full Disclosure mailing list archives
Cross Site Scripting in Webbased Virusencyclopedia
From: Redaktion-Kryptocrew <momolly () kryptocrew de>
Date: Sun, 31 Aug 2003 13:10:15 +0200
Vulnerability: XSS in Webbased Virusencyclopedia Found: 29 Aug 2003 Vendor: Trendmicro/Europe Vendor notified: 30 Aug 2003 Vendor response: no Public release: 31 Aug 2003 We were surfing trendmicro's virusencyclopedia, misspelling the msblaster URL. typing a 'g' instead of an 'a' led to an identical site containing an msblast 'g' version. Donnie Werner discovered possibilities to inject even harmful scripts using probably all the *.trendmicro-europe.com urls (tested: de,fr,it). He successfully executed remote code using the ADODB exploit. Trendmicro overlooked this fault in their european websites, but it looks like they are already working on this issue. Only the european websites are exploitable in this way.. Example: http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&VName=Virus%20ABCDE<br><h3><a%20href=http://www.kryptocrew.de/ba dfile.exe>download%20this%20removal%20tool!%20NOW!!!</a></h3> Thanks to: Donnie Werner (exploitlabs.com), Roland Brecht (kryptocrew.de) & Alexander Mueller (ec-security.com) Regards G.P -- ====================================================================== G.P Online-Redaktion =============================== Kryptocrew .: your security advisor team :. mailto:momolly () kryptocrew de ====================================================================== _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Cross Site Scripting in Webbased Virusencyclopedia Redaktion-Kryptocrew (Aug 31)