IRM Security Advisory: VeriSign Kontiki Delivery Management System (DMS) Cross-Site Scripting Vulnerability

["IRM Research" <IRMResearch () irmplc com>]

VeriSign Kontiki Delivery Management System (DMS) Cross-Site Scripting
Vulnerability 

(CVE Number: CVE-2008-4393) 

 

Vulnerability Type / Importance: XSS / Medium 

 

Problem discovered: September 24th 2007 

Vendor contacted: September 26th 2007 

Advisory published: March 28th 2008 

 

Abstract 

The Kontiki Delivery Management System (DMS) is "a low-cost enterprise
content delivery system that helps large companies rapidly deliver
compelling, rich media communications to employees, customers, and
partners." 

Kontiki DMS is vulnerable to a cross-site scripting attack based on the
manipulation of URL parameters of a site running this service. 

 

Description

During a recent penetration test, a cross-site scripting vulnerability
was discovered in a Kontiki DMS servlet. The vulnerability can be tested
by entering JavaScript in the URL as shown in the example below: 

 

http://server/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.co
okie)%3C/script%3E

 

The server would process the code and execute the JavaScript on the
user's browser. 

Verisign was contacted and immediately confirmed that this was indeed a
security issue and set about producing a patch to include in the next
update for the product. 

 

Affected Versions 

Kontiki DMS Version <= 5.0 

 

Operating Systems Tested 

Microsoft Windows 

 

Vendor & Patch Information 

Verisign has released a patch to resolve this issue, which can be
downloaded from https://customersupport.kontiki.com/software/patch-20102

 

Workarounds 

IRM is not aware of any workarounds for this issue. 

 

Credits 

Research & Advisory: Mazin Faour 

 

Disclaimer 

All information in this advisory is provided on an 'as is' basis in the
hope that it will be useful. Information Risk Management Plc is not
responsible for any risks or occurrences caused by the application of
this information.

 

http://www.irmplc.com/researchlab

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/