Tlen.pl Instant Messenger Remote Script Execution Vulnerability

Bugtraq ID:	12050
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2004 12:00AM
Updated:	Dec 20 2004 12:00AM
Credit:	Discovery is credited to Jaroslaw Sajko <[email protected]>.
Vulnerable:	Tlen.pl Tlen.pl 5.23.4 .1
Not Vulnerable:	Tlen.pl Tlen.pl 5.23.4 .2

Tlen.pl Instant Messenger Remote Script Execution Vulnerability

Tlen.pl is reported prone to a potential script execution vulnerability. It is reported that this issue may allow remote attackers to execute arbitrary script code on a vulnerable computer, which may lead to various attacks.

Tlen.pl 5.23.4.1 and prior versions are affected by this vulnerability.

Tlen.pl Instant Messenger Remote Script Execution Vulnerability

An exploit is not required.

The following proof of concept is available:
www.tlen.pl"style=background-image:url(javascript:alert(%22You%20are%20owned!%22));.pl

Tlen.pl Instant Messenger Remote Script Execution Vulnerability

Solution:
It is reported that Tlen.pl version 5.23.4.2 addresses this issue. This is not confirmed at the moment. Please contact the vendor before upgrading to the new version.


Tlen.pl Tlen.pl 5.23.4 .1

• Tlen.pl Tlen.pl 5.23.4.2
  http://j.o2.pl/idi/tleninst52342.exe

Tlen.pl Instant Messenger Remote Script Execution Vulnerability

References:

• Tlen.pl Home Page (Tlen.pl)