You are here

T-680:Samba SWAT 'user' Field Cross Site Scripting Vulnerability

August 1, 2011 - 2:10pm

Addthis

PROBLEM:

Samba SWAT 'user' Field Cross Site Scripting Vulnerability

PLATFORM:

All Linux

ABSTRACT:

It was found that the 'Change Password' page / screen of the Samba Web Administration Tool did not properly sanitize content of the user-provided "user" field, prior printing it back to the page content. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could allow the attacker to conduct cross-site scripting attacks (execute arbitrary HTML or script code).

reference LINKS:

SecurityFocus - Bugtraq ID: 48901
Secunia CVE Reference: CVE-2011-2694
Red Hat Bugzilla - Bug 722537

IMPACT ASSESSMENT:

Moderate

Discussion:

Samba SWAT is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Solution:

Updates are available, please see the refernces for more information.

Slackware Linux 13.1
Slackware samba-3.5.10-i486-1_slack13.1.txz ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ samba-3.5.10-i486-1_slack13.1.txz

Slackware Linux x86_64 -current
Slackware samba-3.5.10-x86_64-1.txz ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ n/samba-3.5.10-x86_64-1.txz

Slackware Linux 13.37
Slackware samba-3.5.10-i486-1_slack13.37.txz ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages /samba-3.5.10-i486-1_slack13.37.txz
 

Addthis