lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 3 May 2011 15:57:37 +1000
From: "Lists" <>
To: "Bugtraq" <>
Subject: Proofpoint Protection Server Cross-Site Scripting Vulnerability - SOS-11-005

Sense of Security - Security Advisory - SOS-11-005
Release Date.                  03-May-2011
Last Update.                   -
Vendor Notification Date.      28-Apr-2011
Product.                       Proofpoint Protection Server
Platform.                      Appliance
Affected versions.             5.5.5 (verified), and possibly others
Severity Rating.               Medium
Impact.                        Cookie/credential theft,
                               impersonation, loss of confidentiality
Attack Vector.                 Remote without authentication
Solution Status.               Vendor patch
CVE reference.                 Not yet assigned
The Proofpoint Protection Server offers anti-spam and anti-virus,
connection management, email firewall and policy enforcement features.
A Cross-Site Scripting (XSS) vulnerability has been discovered in the 
Proofpoint Protection Server where input is passed to the query string 
of process.cgi. This has occurred as a result of the application not 
properly filtering HTML tags which allows malicious JavaScript to be 
embedded. When input is incorrectly validated and not properly sanitised 
and then displayed in a web page, attackers can trick users into viewing 
the web page and causing malicious code to be executed.
Proof of Concept.
The Cross-Site Scripting vulnerability can be triggered by using the 
following URL:
Where: is the internal FQDN of the Proofpoint
appliance (this is the link received in the 'quarantine mail alert' email)
Note: the recipient and msg_id parameters do not need to be valid (exist on
Proofpoint) to trigger the vulnerability.
The vendor has advised that 'Patch 1084' is now available, 
and should be applied to fix this issue.
Discovered by.
Karan Khosla - Sense of Security Labs.
About us.
Sense of Security is a leading provider of information
security and risk management solutions. Our team has expert
skills in assessment and assurance, strategy and architecture,
and deployment through to ongoing management. We are
Australia's premier application penetration testing firm and
trusted IT security advisor to many of the country's largest

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:

Other Sense of Security advisories can be found at: 

Powered by blists - more mailing lists