[Full-Disclosure] Cross Site Scripting in Webbased Virusencyclopedia

• Previous message: Jose Ronnick: "Re: Overwriting the .dtors section with gcc 3"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Vulnerability:     XSS in Webbased Virusencyclopedia
Found:             29 Aug 2003
Vendor:            Trendmicro/Europe
Vendor notified:   30 Aug 2003
Vendor response:   no
Public release:    31 Aug 2003


We were surfing trendmicro's virusencyclopedia, misspelling the
msblaster URL. typing a 'g' instead of an 'a' led to an identical
site containing an msblast 'g' version.
Donnie Werner discovered possibilities to inject even harmful
scripts using probably all the *.trendmicro-europe.com urls (tested:
de,fr,it). He successfully executed remote code using the ADODB
exploit.

Trendmicro overlooked this fault in their european websites, but it
looks like they are already working on this issue. Only the european
websites are exploitable in this way..


Example: 
http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&VName=Virus%20ABCDE><h3><a%20href=http://www.kryptocrew.de/ba

dfile.exe>download%20this%20removal%20tool!%20NOW!!!</a></h3>




Thanks to:
Donnie Werner (exploitlabs.com), Roland Brecht (kryptocrew.de) & Alexander Mueller (ec-security.com)


Regards
G.P
--
======================================================================

G.P
Online-Redaktion

===============================

Kryptocrew
.: your security advisor team :.           mailto:momollyat_private

======================================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Previous message: Jose Ronnick: "Re: Overwriting the .dtors section with gcc 3"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Aug 31 2003 - 04:36:56 PDT