RSA Security RSA Authentication Agent For Web For IIS XSS

This script is Copyright (C) 2005-2011 Tenable Network Security, Inc.


Synopsis :

A web application on the remote host has a cross-site scripting
vulnerability.

Description :

The remote host appears to be running RSA Authentication Agent for
Web for IIS.

The remote version of this application fails to adequately sanitize
input to the 'postdata' variable of IISWebAgentIF.dll. A remote
attacker could exploit this by tricking a user into requesting a
maliciously crafted URL.

See also :

http://www.oliverkarow.de/research/rsaxss.txt

Solution :

Upgrade to RSA Authentication Agent for Web for IIS 5.3 or later.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 4.3
(CVSS2#E:H/RL:U/RC:ND)
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 18213 ()

Bugtraq ID: 13168

CVE ID: CVE-2005-1118