Executive Summary
| Summary | |
|---|---|
| Title | htdig security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2005:090 | First vendor Publication | 2005-02-15 |
| Vendor | RedHat | Last vendor Modification | 2005-02-15 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated htdig packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The ht://Dig system is a Web search and indexing system for a small domain or intranet. Michael Krax reported a cross-site scripting bug affecting htdig. An attacker could construct a carefully crafted URL which can cause a web browser to execute malicious script once visited. The Common Vulnerabilities and Exposures project has assigned the name CAN-2005-0085 to this issue. Users of htdig should upgrade to these updated packages, which contain a backported patch, and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 144261 - CAN-2005-0085 XSS vulnerability in htdig 3.2.0b6 145649 - htdig packaging cleanups |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2005-090.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10878 | |||
| Oval ID: | oval:org.mitre.oval:def:10878 | ||
| Title: | Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message. | ||
| Description: | Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0085 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for htdig File : nvt/sles9p5018082.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-16 (htdig) File : nvt/glsa_200502_16.nasl |
| 2008-09-04 | Name : FreeBSD Ports: htdig File : nvt/freebsd_htdig.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 680-1 (htdig) File : nvt/deb_680_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 13520 | ht://Dig (htdig) config Parameter XSS ht://Dig (htdig) contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'config' parameter upon submission to an unspecified script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_9833.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_673aec6f1cae11dabc01000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
| 2005-04-01 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-063.nasl - Type : ACT_GATHER_INFO |
| 2005-02-22 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-073.nasl - Type : ACT_GATHER_INFO |
| 2005-02-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-090.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-680.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-16.nasl - Type : ACT_GATHER_INFO |
| 2005-02-08 | Name : The remote host contains a web search engine that is affected by a cross-site... File : htdig_xss2.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:49:00 |
|
