bugtraq - [Update]:Cross Site Scripting in Webbased Virusencyclopedia has fixed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7938540558.20030901175320@kryptocrew.de>
Date: Mon, 1 Sep 2003 17:53:20 +0200
From: Redaktion-Kryptocrew <momolly@...ptocrew.de>
To: full-disclosure@...ts.netsys.com, bugtraq@...urityfocus.com,
   vuln-dev@...urityfocus.com, <vuln@...unia.com>
Subject: [Update]:Cross Site Scripting in Webbased Virusencyclopedia has fixed

Vulnerability:     XSS in Webbased Virusencyclopedia
Found:             29 Aug 2003
Vendor:            Trendmicro/Europe
Vendor notified:   30 Aug 2003
Vendor response:   01 Aug 2003
Public release:    31 Aug 2003
Update:            01 Aug 2003

We were surfing trendmicro's virusencyclopedia, misspelling the
msblaster URL. typing a 'g' instead of an 'a' led to an identical
site containing an msblast 'g' version.
Donnie Werner discovered possibilities to inject even harmful
scripts using probably all the *.trendmicro-europe.com urls (tested:
de,fr,it). He successfully executed remote code using the ADODB
exploit.

Trendmicro overlooked this fault in their european websites, but it
looks like they are already working on this issue. Only the european
websites are exploitable in this way..

Example: 
http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&VName=Virus%20ABCDE<br><h3><a%20href=http://www.kryptocrew.de/ba

dfile.exe>download%20this%20removal%20tool!%20NOW!!!</a></h3>

Update:
Vendor has fixed this vulnerable.
TrendMicro will overlook the complete EMEA Sites within the
next days to remove all kinds of exploits.

Thanks to:
Donnie Werner (exploitlabs.com), Roland Brecht (kryptocrew.de) & Alexander Mueller (ec-security.com)

Regards
G.P
--
======================================================================

G.P
Online-Redaktion

===============================

Kryptocrew
.: your security advisor team :.           mailto:momolly@...ptocrew.de

======================================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html