Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2011:031 | First vendor Publication | 2011-02-18 |
| Vendor | Mandriva | Last vendor Modification | 2011-02-18 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities has been found and corrected in python-django: Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a combination of browser plugins and redirects, a related issue to CVE-2011-0447 (CVE-2011-0696). Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload (CVE-2011-0697). Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays (CVE-2011-0698). The updated packages have been upgraded to the 1.1.4 version which is not vulnerable to these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2011:031 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-352 | Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25) |
| 25 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 25 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12419 | |||
| Oval ID: | oval:org.mitre.oval:def:12419 | ||
| Title: | DSA-2163-1 python-django -- multiple | ||
| Description: | Several vulnerabilities were discovered in the django web development framework: CVE-2011-0696 For several reasons the internal CSRF protection was not used to validate ajax requests in the past. However, it was discovered that this exception can be exploited with a combination of browser plugins and redirects and thus is not sufficient. CVE-2011-0697 It was discovered that the file upload form is prone to cross-site scripting attacks via the file name. It is important to note that this update introduces minor backward incompatibilities due to the fixes for the above issues. Packages in the oldstable distribution are not affected by these problems. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2163-1 CVE-2011-0696 CVE-2011-0697 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | python-django |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12682 | |||
| Oval ID: | oval:org.mitre.oval:def:12682 | ||
| Title: | DSA-2163-2 dajaxice -- multiple | ||
| Description: | The changes in python-django DSA-2163 necessary to fix the issues CVE-2011-0696 and CVE-2011-0697 introduced an unavoidable backward incompatibility, which caused a regression in dajaxice, which depends on python-django. This update supplies fixed packages for dajaxice. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2163-2 CVE-2011-0696 CVE-2011-0697 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | dajaxice |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12893 | |||
| Oval ID: | oval:org.mitre.oval:def:12893 | ||
| Title: | DSA-2247-1 rails -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in Rails, the Ruby web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2011-0446 Multiple cross-site scripting vulnerabilities when JavaScript encoding is used, allow remote attackers to inject arbitrary web script or HTML. CVE-2011-0447 Rails does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2247-1 CVE-2011-0446 CVE-2011-0447 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | rails |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13659 | |||
| Oval ID: | oval:org.mitre.oval:def:13659 | ||
| Title: | USN-1066-1 -- python-django vulnerabilities | ||
| Description: | It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery attacks. It was discovered that Django did not properly sanitize its input when performing file uploads, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1066-1 CVE-2011-0696 CVE-2011-0697 | Version: | 5 |
| Platform(s): | Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 | Product(s): | python-django |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-09-30 | Name : Fedora Update for Django FEDORA-2011-12481 File : nvt/gb_fedora_2011_12481_Django_fc14.nasl |
| 2011-09-12 | Name : Fedora Update for rubygem-actionpack FEDORA-2011-11567 File : nvt/gb_fedora_2011_11567_rubygem-actionpack_fc14.nasl |
| 2011-09-12 | Name : Fedora Update for audacious-plugins FEDORA-2011-12350 File : nvt/gb_fedora_2011_12350_audacious-plugins_fc15.nasl |
| 2011-08-03 | Name : Debian Security Advisory DSA 2247-1 (rails) File : nvt/deb_2247_1.nasl |
| 2011-03-09 | Name : Debian Security Advisory DSA 2163-2 (dajaxice) File : nvt/deb_2163_2.nasl |
| 2011-03-08 | Name : Fedora Update for rubygem-actionpack FEDORA-2011-2133 File : nvt/gb_fedora_2011_2133_rubygem-actionpack_fc14.nasl |
| 2011-03-08 | Name : Fedora Update for rubygem-actionpack FEDORA-2011-2138 File : nvt/gb_fedora_2011_2138_rubygem-actionpack_fc13.nasl |
| 2011-03-07 | Name : Debian Security Advisory DSA 2163-1 (python-django) File : nvt/deb_2163_1.nasl |
| 2011-02-22 | Name : Fedora Update for Django FEDORA-2011-1235 File : nvt/gb_fedora_2011_1235_Django_fc14.nasl |
| 2011-02-22 | Name : Fedora Update for Django FEDORA-2011-1261 File : nvt/gb_fedora_2011_1261_Django_fc13.nasl |
| 2011-02-22 | Name : Mandriva Update for python-django MDVSA-2011:031 (python-django) File : nvt/gb_mandriva_MDVSA_2011_031.nasl |
| 2011-02-18 | Name : Ubuntu Update for python-django vulnerabilities USN-1066-1 File : nvt/gb_ubuntu_USN_1066_1.nasl |
| 2010-08-02 | Name : Ruby on Rails Cross Site Request Forgery Vulnerability File : nvt/secpod_ruby_rails_csrf_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 71001 | Django Session Cookie / Character Traversal Arbitrary File Access Django contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to thefile-based session storage system not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the key in a session cookie. This directory traversal attack would allow the attacker to access arbitrary files. |
| 71000 | Django File Upload Field Filename XSS Django contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the filename of uploaded files upon submission to the 'file' field. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 70999 | Django X-Requested-With Header CSRF Django contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not properly validate HTTP requests that contain an X-Requested-With header. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may use a forged Ajax request to trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification. |
| 70927 | Ruby on Rails Ajax/API Request CSRF Protection Bypass Ruby on Rails contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for AJAX or API HTTP requests that contain a X-Requested-With header. This makes it easier for an attacker to use a crafted URL (e.g., a crafted GET request inside an "img" tag) to trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-28.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_rubygem-actionmailer-111116.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_rubygem-actionmailer-111116.nasl - Type : ACT_GATHER_INFO |
| 2011-06-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2247.nasl - Type : ACT_GATHER_INFO |
| 2011-04-06 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2011-4358.nasl - Type : ACT_GATHER_INFO |
| 2011-03-07 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2133.nasl - Type : ACT_GATHER_INFO |
| 2011-03-07 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2138.nasl - Type : ACT_GATHER_INFO |
| 2011-02-20 | Name : The remote Fedora host is missing a security update. File : fedora_2011-1235.nasl - Type : ACT_GATHER_INFO |
| 2011-02-20 | Name : The remote Fedora host is missing a security update. File : fedora_2011-1261.nasl - Type : ACT_GATHER_INFO |
| 2011-02-20 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2011-031.nasl - Type : ACT_GATHER_INFO |
| 2011-02-18 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1066-1.nasl - Type : ACT_GATHER_INFO |
| 2011-02-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2163.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:42:04 |
|
