SNS Vulnerability

Apache Web Server "mod_imap" Module Cross Site Scripting Vulnerability

Description

A vulnerability has been identified in Apache, which could be exploited to conduct cross site scripting attacks. This issue is caused by an input validation error in the "mod_imap" module when processing user-supplied data while an imagemap file is publicly available, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser.

Vulnerable Products

Vulnerable Software:
Apache version 1.3.39Apache version 1.3.37Apache version 1.3.36Apache version 1.3.35Apache version 1.3.34Apache version 1.3.33Apache version 1.3.32Apache version 1.3.31Apache version 1.3.29Apache version 1.3.28Apache version 1.3.27Apache version 1.3.26Apache version 1.3.24Apache version 1.3.22Apache version 1.3.20Apache version 1.3.19Apache version 1.3.17Apache version 1.3.14Apache version 1.3.12Apache version 1.3.11Apache version 1.3.9Apache version 1.3.6Apache version 1.3.4Apache version 1.3.3Apache version 1.3.2Apache version 1.3.1Apache version 1.3.0Apache version 2.0.61Apache version 2.0.59Apache version 2.0.58Apache version 2.0.55Apache version 2.0.54Apache version 2.0.53Apache version 2.0.52Apache version 2.0.51Apache version 2.0.50Apache version 2.0.49Apache version 2.0.48Apache version 2.0.47Apache version 2.0.46Apache version 2.0.45Apache version 2.0.44Apache version 2.0.43Apache version 2.0.42Apache version 2.0.40Apache version 2.0.39Apache version 2.0.37Apache version 2.0.36Apache version 2.0.35

Solution

Upgrade to Apache version 1.3.40-dev or 2.0.62-dev : http://httpd.apache.org/download.cgi

CVE

CVE-2007-5000

References

http://httpd.apache.org/security/vulnerabilities_13.html
http://httpd.apache.org/security/vulnerabilities_20.html

Vulnerability Manager Detection

Yes (since ASQ v3.5.0)

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious tag with event found in data	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	3.2.0
XSS - Prevention - POST : 'location' javascript object found in data	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - POST : javascript code found in data	3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	3.2.0
XSS - Prevention - POST : code allowing cookie access found in data	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - POST : 'script' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0

Risk level

Low

Vulnerability First Public Report Date

2007-12-13

Target Type

Server

Possible exploit

Local & Remote