Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-1036 | First vendor Publication | 2008-06-02 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1036 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10824 | |||
| Oval ID: | oval:org.mitre.oval:def:10824 | ||
| Title: | The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| Description: | The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-1036 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13393 | |||
| Oval ID: | oval:org.mitre.oval:def:13393 | ||
| Title: | DSA-1762-1 icu -- insufficient input sanitising | ||
| Description: | It was discovered that icu, the internal components for Unicode, did not properly sanitise invalid encoded data, which could lead to cross- site scripting attacks. For the stable distribution, this problem has been fixed in version 3.8.1-3+lenny1. For the oldstable distribution, this problem has been fixed in version 3.6-2etch2. For the testing distribution and the unstable distribution, this problem has been fixed in version 4.0.1-1. We recommend that you upgrade your icu packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1762-1 CVE-2008-1036 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | icu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13794 | |||
| Oval ID: | oval:org.mitre.oval:def:13794 | ||
| Title: | USN-747-1 -- icu vulnerability | ||
| Description: | It was discovered that libicu did not correctly handle certain invalid encoded data. If a user or automated system were tricked into processing specially crafted data with applications linked against libicu, certain content filters could be bypassed. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-747-1 CVE-2008-1036 | Version: | 5 |
| Platform(s): | Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 | Product(s): | icu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21796 | |||
| Oval ID: | oval:org.mitre.oval:def:21796 | ||
| Title: | ELSA-2009:0296: icu security update (Moderate) | ||
| Description: | The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:0296-01 CVE-2008-1036 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | icu |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29195 | |||
| Oval ID: | oval:org.mitre.oval:def:29195 | ||
| Title: | RHSA-2009:0296 -- icu security update (Moderate) | ||
| Description: | Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036) All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:0296 CVE-2008-1036 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | icu |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 4 | |
| Os | 4 | |
| Os | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-05-12 | Name : Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003 File : nvt/macosx_upd_10_5_3_secupd_2008-003.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-06-05 | Name : Ubuntu USN-743-1 (gs-gpl) File : nvt/ubuntu_743_1.nasl |
| 2009-06-05 | Name : Ubuntu USN-744-1 (lcms) File : nvt/ubuntu_744_1.nasl |
| 2009-04-06 | Name : Debian Security Advisory DSA 1762-1 (icu) File : nvt/deb_1762_1.nasl |
| 2009-04-06 | Name : Ubuntu USN-746-1 (xine-lib) File : nvt/ubuntu_746_1.nasl |
| 2009-04-06 | Name : Ubuntu USN-747-1 (icu) File : nvt/ubuntu_747_1.nasl |
| 2009-03-13 | Name : RedHat Security Advisory RHSA-2009:0296 File : nvt/RHSA_2009_0296.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 45704 | International Components for Unicode (ICU) Unspecified Character Encoding Wea... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0296.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090312_icu_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-747-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1762.nasl - Type : ACT_GATHER_INFO |
| 2009-03-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0296.nasl - Type : ACT_GATHER_INFO |
| 2008-05-29 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_3.nasl - Type : ACT_GATHER_INFO |
| 2008-05-29 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-003.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:14:16 |
|
| 2024-11-28 12:15:02 |
|
| 2021-05-04 12:07:11 |
|
| 2021-04-22 01:07:36 |
|
| 2020-05-23 00:21:20 |
|
| 2017-09-29 09:23:25 |
|
| 2017-08-08 09:23:53 |
|
| 2016-04-26 17:10:11 |
|
| 2014-02-17 10:43:59 |
|
| 2013-05-11 00:10:26 |
|
