SafeHTML UTF-7 And CSS Comment Tag Cross Site Scripting Vulnerabilities

Bugtraq ID:	14574
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2005 12:00AM
Updated:	Aug 16 2005 12:00AM
Credit:	The vendor released this vulnerability.
Vulnerable:	SafeHTML SafeHTML 1.3.2
Not Vulnerable:	SafeHTML SafeHTML 1.3.5

SafeHTML UTF-7 And CSS Comment Tag Cross Site Scripting Vulnerabilities

SafeHTML is prone to cross-site scripting vulnerabilities, specifically in dealing with UTF-7 encoding of characters and with CSS comment tags.

Failure to filter HTML content can result in the exploitation of various latent vulnerabilities in Web based applications. A successful attack may facilitate HTML injection or cross-site scripting type issues.

SafeHTML UTF-7 And CSS Comment Tag Cross Site Scripting Vulnerabilities

An exploit is not required.

SafeHTML UTF-7 And CSS Comment Tag Cross Site Scripting Vulnerabilities

Solution:
The vendor has released version 1.3.5 to resolve this issue.


SafeHTML SafeHTML 1.3.2

• SafeHTML safehtml-1.3.5.zip
  http://pixel-apes.com/download/safehtml-1.3.5.zip

SafeHTML UTF-7 And CSS Comment Tag Cross Site Scripting Vulnerabilities

References:

• SafeHTML Change Log (SafeHTML)
  
• SafeHTML Home Page (SafeHTML)