Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of these details are obtained from third party information.

According to its self-reported version number, the HP System Management Homepage install on the remote host is earlier than 6.0.0.96 / 6.0.0-95.  Such versions are potentially affected by the following vulnerabilities :

  - A cross-site scripting (XSS) vulnerability due to a     failure to sanitize UTF-7 encoded input.  Browsers are     only affected if encoding is set to auto-select.
    (CVE-2008-1468)

  - An integer overflow in the libxml2 library that can     result in a heap overflow. (CVE-2008-4226)

  - A buffer overflow in the PHP mbstring extension.
    (CVE-2008-5557)

  - An unspecified XSS in PHP when 'display_errors' is     enabled. (CVE-2008-5814)

  - Multiple denial of service vulnerabilities in OpenSSL     DTLS. (CVE-2009-1377, CVE-2009-1378, CVE-2009-1379,     CVE-2009-1386, CVE-2009-1387)

  - A cross-site scripting vulnerability due to a failure     to sanitize input to the 'servercert' parameter of     '/proxy/smhu/getuiinfo'.  (CVE-2009-4185)

  - An unspecified vulnerability that could allow an     attacker to access sensitive information, modify data,     or cause a denial of service. (CVE-2010-1034)

This version upgrade is provided to fix a UTF-7 cross-site-scripting vulnerabilitiy. (CVE-2008-1468)

- Mon Mar 24 2008 Akira TAGOH <tagoh at redhat.com> -     2.0.18-1

    - security fix (#438664)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
46015	HP System Management Homepage < 6.0.0.96 / 6.0.0-95 Multiple Vulnerabilities	Nessus	Web Servers	critical
34027	openSUSE 10 Security Update : namazu (namazu-5523)	Nessus	SuSE Local Security Checks	medium
31692	Fedora 8 : namazu-2.0.18-1.fc8 (2008-2767)	Nessus	Fedora Local Security Checks	medium
31690	Fedora 7 : namazu-2.0.18-1.fc7 (2008-2678)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1468

medium

Tenable Plugins

critical

medium

medium

medium