Vulnerability Bulletins |
Múltiples vulnerabilidades cross-site scripting en Gforge |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de la visibilidad |
| Dificulty | Avanzado |
| Required attacker level | Acceso remoto sin cuenta a un servicio exotico |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | GForge 4.5 |
Description |
|
|
Se han descubierto múltiples vulnerabilidades en Gforge 4.5. La vulnerabilidad reside en múltiples errores de validación de la entrada del usuario en los parámetros "forum_id" o "group_id" de "forum.php", el parámetro "project_task_id" de "task.php", el parámetro "id" de "detail.php", el campo de texto de la página de búsqueda, el parámetro "group_id" de "qrs.php", los parámetros "form", "rows", "cols" o "wrap" de "notepad.php", o el campo "login" en el formulario de autenticación. Un atacante remoto podría inyectar código web script o HTML para realizar ataques Cross-Site Scripting. |
|
Solution |
|
|
Actualización de software Debian Debian Linux 3.1 Source http://security.debian.org/pool/updates/main/g/gforge/gforge_3.1-31sarge1.dsc http://security.debian.org/pool/updates/main/g/gforge/gforge_3.1-31sarge1.diff.gz http://security.debian.org/pool/updates/main/g/gforge/gforge_3.1.orig.tar.gz Architecture independent http://security.debian.org/pool/updates/main/g/gforge/gforge-common_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-cvs_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-db-postgresql_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-dns-bind9_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-ftp-proftpd_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-ldap-openldap_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-lists-mailman_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-mta-exim4_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-mta-exim_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-mta-postfix_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-shell-ldap_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-sourceforge-transition_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge-web-apache_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/gforge_3.1-31sarge1_all.deb http://security.debian.org/pool/updates/main/g/gforge/sourceforge_3.1-31sarge1_all.deb |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2005-2430 |
| BID | 14405 |
Other resources |
|
|
Debian Security Advisory (DSA 1094-1) http://lists.debian.org/debian-security-announce/debian-security-announce-2006/msg00180.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2006-06-09 |