JVN#18616622
Multiple Tor World CGI scripts vulnerable to arbitrary script execution
Overview
Multiple Tor World CGI scripts contain a vulnerability which may allow an arbitrary script execution.
Products Affected
- Simple BBS Ver1.86 and earlier
- Interactive BBS Ver1.57 and earlier
- Topics BBS Ver1.11 and earlier
- Tor Board Ver1.3 and earlier
Description
Tor World provides CGI scripts for implementing search engines, message boards, and other tools. Multiple Tor World CGI scripts contain a vulnerability which may allow an attacker to inject an arbitrary script into the web page which is generated by the affected product.
This vulnerability is different from JVN#54593414.
Impact
An arbitrary script may be executed on the user's web browser.
Solution
Update the Software
Apply the latest updates provided by the vendor.
References
JPCERT/CC Addendum
The vendor has released the information regarding this issue on September 5, 2008.Vulnerability Analysis by JPCERT/CC
Analyzed on 2008.09.10
| Measures | Conditions | Severity |
|---|---|---|
| Access Required | Routed - can be attacked over the Internet using packets |
|
| Authentication | None - anonymous or no authentication (IP addresses do not count) |
|
| User Interaction Required | Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file |
|
| Exploit Complexity | Low - little to no expertise and/or luck required to exploit (cross-site scripting) |
|
Credit
Yutaka Kokubu of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under the Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory | |
| CPNI Advisory | |
| TRnotes | |
| CVE |
CVE-2008-4076 |
| JVN iPedia |
JVNDB-2008-000058 |