Bug 214266 – app-text/namazu <2.0.18 namazu.cgi UTF-7 Cross-Site Scripting (CVE-2008-1468)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Robert Buchholz (RETIRED) 2008-03-22 16:00:25 UTC]

Secunia:
A vulnerability has been reported in Namazu, which can be exploited
by malicious people to conduct cross-site scripting attacks.

Input passed in certain character encodings (e.g. UTF-7) to
namazu.cgi is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 2.0.18.

SOLUTION:
Update to version 2.0.18.

PROVIDED AND/OR DISCOVERED BY:
Reported via JVN.

ORIGINAL ADVISORY:
JVN: http://jvn.jp/jp/JVN%2300892830/index.html
Namazu: http://www.namazu.org/security.html.en

[Comment 1 Robert Buchholz (RETIRED) 2008-03-22 16:00:47 UTC]

please bump.

[Comment 2 MATSUU Takuto (RETIRED) 2008-03-24 17:21:48 UTC]

2.0.18 in cvs.

[Comment 3 Robert Buchholz (RETIRED) 2008-03-24 17:25:18 UTC]

Arches, please test and mark stable:
=app-text/namazu-2.0.18
Target keywords : "ppc64 release x86"

[Comment 4 Christian Faulhammer (RETIRED) 2008-03-25 20:03:50 UTC]

x86 stable

[Comment 5 Markus Rothe (RETIRED) 2008-03-26 16:49:47 UTC]

ppc64 stable

[Comment 6 Peter Volkov (RETIRED) 2008-03-26 19:27:49 UTC]

Fixed in release snapshot.

[Comment 7 Robert Buchholz (RETIRED) 2008-03-29 19:49:41 UTC]

I vote NO.

[Comment 8 Tobias Heinlein (RETIRED) 2008-03-29 19:58:06 UTC]

Voting NO too and closing.