[Full-Disclosure] [Update]:Cross Site Scripting in Webbased Virusencyclopedia has fixed

From: Redaktion-Kryptocrew (momollyat_private)
Date: Mon Sep 01 2003 - 08:53:20 PDT

  • Next message: morning_wood: "[Full-Disclosure] PtHProductions Gastenboek - XSS"

    Vulnerability:     XSS in Webbased Virusencyclopedia
    Found:             29 Aug 2003
    Vendor:            Trendmicro/Europe
    Vendor notified:   30 Aug 2003
    Vendor response:   01 Aug 2003
    Public release:    31 Aug 2003
    Update:            01 Aug 2003
    
    
    We were surfing trendmicro's virusencyclopedia, misspelling the
    msblaster URL. typing a 'g' instead of an 'a' led to an identical
    site containing an msblast 'g' version.
    Donnie Werner discovered possibilities to inject even harmful
    scripts using probably all the *.trendmicro-europe.com urls (tested:
    de,fr,it). He successfully executed remote code using the ADODB
    exploit.
    
    Trendmicro overlooked this fault in their european websites, but it
    looks like they are already working on this issue. Only the european
    websites are exploitable in this way..
    
    
    Example: 
    http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&VName=Virus%20ABCDE><h3><a%20href=http://www.kryptocrew.de/ba
    
    dfile.exe>download%20this%20removal%20tool!%20NOW!!!</a></h3>
    
    Update:
    Vendor has fixed this vulnerable.
    TrendMicro will overlook the complete EMEA Sites within the
    next days to remove all kinds of exploits.
    
    
    Thanks to:
    Donnie Werner (exploitlabs.com), Roland Brecht (kryptocrew.de) & Alexander Mueller (ec-security.com)
    
    
    Regards
    G.P
    --
    ======================================================================
    
    G.P
    Online-Redaktion
    
    ===============================
    
    Kryptocrew
    .: your security advisor team :.           mailto:momollyat_private
    
    ======================================================================
    
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    



    This archive was generated by hypermail 2b30 : Mon Sep 01 2003 - 09:48:38 PDT