Published:2007/07/20  Last Updated:2008/05/21

JVN#34058672
Nessus report function vulnerable to arbitrary script execution

Overview

Nessus scanning report in HTML format contains the target server's responses against Nessus scanning. Nessus fails to properly handle the responses. This may cause a script to be executed on a user's web browser when the user views the report.

Products Affected

  • Nessus 3.0.5 Windows and earlier
For more information, refer to the vendor's website.

Description

Nessus, a vulnerability scanner from Tenable Network Security, Inc., is capable of providing test reports in HTML format. The report in HTML format contains the target server's responses against Nessus scanning. Nessus fails to properly handle the responses. This may cause a script to be executed on a user's web browser when the user views the report.

Impact

When a user views the Nessus report in HTML format, an arbitrary script may be executed in the user's web browser.

Solution

Update the Software
Apply the latest updates provided by the vendor.

Vendor Status

Vendor Link
Tenable Network Security, Inc. Nessus 3.0.6 released

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2007.07.20

Measures Conditions Severity
Access Required Routed - can be attacked over the Internet using packets
  • High
Authentication None - anonymous or no authentication (IP addresses do not count)
  • High
User Interaction Required Complex - the user must be convinced to take a difficult or suspicious action. If the honest user must have elevated privileges, they are likely to be more suspicious
  • Low
Exploit Complexity Low - little to no expertise and/or luck required to exploit (cross-site scripting)
  • High

Description of each analysis measures

We analyzed "User Interaction Required" as "Complex" by considering the nature of the software.

Credit

Daiki Fukumori of Secure Sky Technology, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia JVNDB-2007-000548

Update History