SNS Vulnerability

Mandriva Security Update Fixes JpGraph Cross Site Scripting Vulnerability

Description

A vulnerability has been identified in Mandriva, which could be exploited by attackers to execute arbitrary scripting code. This issue is caused by an input validation error in the "GetURLArguments()" function in "jpgraph.php" in Aditus Consulting JpGraph when processing user-supplied data, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected site.

Vulnerable Products

Vulnerable Software:
Mandriva Corporate 4.0Mandriva Enterprise Server 5.0

Solution

Upgrade the affected packages :Corporate 4.0:937be39b1d94431f61f94a3c5a4258d5 corporate/4.0/i586/php5-jpgraph-2.1.1-1.1.20060mlcs4.noarch.rpm13863f4c1328886d373594dcc7d18567 corporate/4.0/i586/php5-jpgraph-doc-2.1.1-1.1.20060mlcs4.noarch.rpm280532b6c7e1f5f8fa76bb1a1764837f corporate/4.0/SRPMS/php5-jpgraph-2.1.1-1.1.20060mlcs4.src.rpmCorporate 4.0/X86_64:3f76e924133cc4b45c107fc0aba9f9c0 corporate/4.0/x86_64/php5-jpgraph-2.1.1-1.1.20060mlcs4.noarch.rpm538e00b525d1513db22e91bcd9fb458d corporate/4.0/x86_64/php5-jpgraph-doc-2.1.1-1.1.20060mlcs4.noarch.rpm280532b6c7e1f5f8fa76bb1a1764837f corporate/4.0/SRPMS/php5-jpgraph-2.1.1-1.1.20060mlcs4.src.rpmMandriva Enterprise Server 5:260ce8f8cd70ec01bf9a2272bb7e1788 mes5/i586/php-jpgraph-2.3.3-1.1mdvmes5.noarch.rpmf74acdcc63262b3a633469699553e9b9 mes5/i586/php-jpgraph-doc-2.3.3-1.1mdvmes5.noarch.rpm647f834fbc35f8bddd3d1eb949d72f9c mes5/SRPMS/php-jpgraph-2.3.3-1.1mdvmes5.src.rpmMandriva Enterprise Server 5/X86_64:07647442d1e29a5bbadcb17f38867ccb mes5/x86_64/php-jpgraph-2.3.3-1.1mdvmes5.noarch.rpm1e4275ac899c4ade8bff0dbcca48af4d mes5/x86_64/php-jpgraph-doc-2.3.3-1.1mdvmes5.noarch.rpm647f834fbc35f8bddd3d1eb949d72f9c mes5/SRPMS/php-jpgraph-2.3.3-1.1mdvmes5.src.rpm

CVE

CVE-2009-4422

References

http://lists.mandriva.com/security-announce/2009-12/msg00134.php

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious tag with event found in data	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	3.2.0
XSS - Prevention - POST : 'location' javascript object found in data	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - POST : javascript code found in data	3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	3.2.0
XSS - Prevention - POST : code allowing cookie access found in data	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - POST : 'script' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0

Risk level

Low

Vulnerability First Public Report Date

2009-12-27

Target Type

Client

Possible exploit

Local & Remote