DSA-109-1 faqomatic -- cross-site scripting vulnerability

Debian Security Advisory

DSA-109-1 faqomatic -- cross-site scripting vulnerability

Date Reported:

13 Feb 2002

Affected Packages:

faqomatic

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2002-0230.

More information:

Due to unescaped HTML code Faq-O-Matic returned unverified scripting code to the browser. With some tweaking this enables an attacker to steal cookies from one of the Faq-O-Matic moderators or the admin.

Cross-Site Scripting is a type of problem that allows a malicious person to make another person run some JavaScript in their browser. The JavaScript is executed on the victims machine and is in the context of the website running the Faq-O-Matic Frequently Asked Question manager.

This problem has been fixed in version 2.603-1.2 for the stable Debian distribution and version 2.712-2 for the current testing/unstable distribution.

We recommend that you upgrade your faqomatic package if you have it installed.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Source:

http://security.debian.org/dists/stable/updates/main/source/faqomatic_2.603-1.2.diff.gz

http://security.debian.org/dists/stable/updates/main/source/faqomatic_2.603-1.2.dsc

http://security.debian.org/dists/stable/updates/main/source/faqomatic_2.603.orig.tar.gz

Architecture-independent component:

http://security.debian.org/dists/stable/updates/main/binary-all/faqomatic_2.603-1.2_all.deb

MD5 checksums of the listed files are available in the original advisory.