Trac Wiki Macro Remote HTML Injection Vulnerabilities

Bugtraq ID:	17741
Class:	Input Validation Error
CVE:	CVE-2005-4190 CVE-2006-2106
Remote:	Yes
Local:	No
Published:	Apr 28 2006 12:00AM
Updated:	Jul 05 2016 09:38PM
Credit:	Mr. Kazuhiro Nishiyama is credited with the discovery of this vulnerability.
Vulnerable:	Trac Trac 0.9.4 Nortel Networks VPN Router 1010 0.9.3
Not Vulnerable:	Trac Trac 0.9.5

Trac Wiki Macro Remote HTML Injection Vulnerabilities

Trac is prone to multiple, unspecified HTML-injection vulnerabilities.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing attackers to steal cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible.

Trac versions prior to 0.9.5. are affected by these issues.

Trac Wiki Macro Remote HTML Injection Vulnerabilities

This issue can be exploited through a web client.

Trac Wiki Macro Remote HTML Injection Vulnerabilities

Solution:

The vendor has released an upgrade (Nag H3 2.0.4) dealing with this issue.

Please see the references for more information and vendor advisories.


Nortel Networks VPN Router 1010 0.9.3

• Trac trac-0.9.5.tar.gz
  ftp://ftp.edgewall.com/pub/trac/trac-0.9.5.tar.gz

Trac Trac 0.9.4

• Trac trac-0.9.5.tar.gz
  ftp://ftp.edgewall.com/pub/trac/trac-0.9.5.tar.gz

Trac Wiki Macro Remote HTML Injection Vulnerabilities

References:

• Trac (Edgewall Software)
  
• Trac Changelog for version 0.9.5 (Trac)