Sun Secure Global Desktop Multiple Unspecified Cross-Site Scripting Vulnerabilities

Bugtraq ID:	20276
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Sep 15 2006 12:00AM
Updated:	Oct 02 2006 05:00PM
Credit:	Sun credits Marc Ruef of scip AG with the discovery of this vulnerability.
Vulnerable:	Sun Secure Global Desktop 4.2
Not Vulnerable:

Sun Secure Global Desktop Multiple Unspecified Cross-Site Scripting Vulnerabilities

Sun Secure Global Desktop is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker could exploit this vulnerability to have arbitrary script code execute in the context of the affected webserver. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Sun Secure Global Desktop Multiple Unspecified Cross-Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Sun Secure Global Desktop Multiple Unspecified Cross-Site Scripting Vulnerabilities

Solution:
The vendor has released version 4.2 build 4.20.983 to address these issues.

Please see the references for information on how to acquire this fix.

Sun Secure Global Desktop Multiple Unspecified Cross-Site Scripting Vulnerabilities

References:

• Cross-site Scripting Vulnerabilities in the Sun Secure Global Desktop Software (Sun)
  
• Sun Secure Global Desktop Homepage (Sun)