CERT-In Vulnerability Note
CIVN-2007-0163
Cross Site Scripting Vulnerability in Apache mod_imap Module
Original Issue Date:December 26, 2007
Severity Rating: HIGH
Systems Affected
- Apache 1.3.x
- Apache 2.2.0, 2.2.2 to 2.2.6
Overview
A cross site scripting vulnerability has been reported in Apache which could be exploited by remote attackers to execute arbitrary code on the affected system.
Description
A vulnerability has been reported in Apache due to an input validation error in the "mod_imagemap" module while processing user-supplied data and an imagemap file is publicly available. This could be exploited by remote attackers to execute arbitrary code by the users browser in context of an affected site.
Successful exploitation requires that "mod_imap" is enabled and a mapfile is publicly available.
Solution
Upgrade to Apache version 1.3.40-dev
http://httpd.apache.org/download.cgi
Upgrade to Apache version 2.0.62-dev :
http://httpd.apache.org/download.cgi
Vendor Information
Apache
http://httpd.apache.org/security/vulnerabilities_13.html
http://httpd.apache.org/security/vulnerabilities_22.html
References
Secunia
http://secunia.com/advisories/28073
FrSirt
http://www.frsirt.com/english/advisories/2007/4202
Securityfocus
http://www.securityfocus.com/bid/26838/info
CVE Name
CVE-2007-5000
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|