BID:20213

eyeOS Multiple Unspecified Cross-Site Scripting Vulnerabilities

Info

eyeOS Multiple Unspecified Cross-Site Scripting Vulnerabilities

Bugtraq ID:	20213
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 26 2006 12:00AM
Updated:	Sep 27 2006 10:51PM
Credit:	Jose Carlos Norte is credited with the discovery of these vulnerabilities.
Vulnerable:	eyeOS eyeOS 0.9 eyeOS eyeOS 0.8.10 eyeOS eyeOS 0.8.9 eyeOS eyeOS 0.8.5 eyeOS eyeOS 0.8.4 -r1 eyeOS eyeOS 0.8.4 eyeOS eyeOS 0.8.3 -r2 eyeOS eyeOS 0.8.3

Not Vulnerable:	eyeOS eyeOS 0.9.1

Discussion

eyeOS Multiple Unspecified Cross-Site Scripting Vulnerabilities

eyeOS is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

eyeOS versions prior to 0.9.1 are vulnerable to these issues.

Exploit / POC

eyeOS Multiple Unspecified Cross-Site Scripting Vulnerabilities

An attacker can exploit these issues via a web client.

Solution / Fix

eyeOS Multiple Unspecified Cross-Site Scripting Vulnerabilities

Solution:
The vendor has released version 0.9.1. to address these issues; please see the references for details.

eyeOS eyeOS 0.8.10