Canon Network Camera Server Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	23560
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 18 2007 12:00AM
Updated:	Apr 19 2007 08:51PM
Credit:	JVN is credited with the discovery of this vulnerability.
Vulnerable:	Canon Network Camera Server VB150 firm V1.1 R39 Canon Network Camera Server VB101 firm V3.0 R69 Canon Network Camera Server VB100 firm V3.0 R69
Not Vulnerable:	Canon Network Camera Server VB150 firm V1.1 R41 Canon Network Camera Server VB101 firm V3.0 R71 Canon Network Camera Server VB100 firm V3.0 R71

Canon Network Camera Server Unspecified Cross Site Scripting Vulnerability

Canon Network Camera Server is prone to an unspecified cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.

Exploiting this issue may help the attacker steal cookie-based authentication credentials and launch other attacks.

These versions of Canon Network Camera Server are vulnerable:

- VB100 firmware V3.0 R69 (and earlier)
- VB101 firmware V3.0 R69 (and earlier)
- VB150 firmware V1.1 R39 (and earlier)

Canon Network Camera Server Unspecified Cross Site Scripting Vulnerability

An attacker can exploit this issue with a browser.

Canon Network Camera Server Unspecified Cross Site Scripting Vulnerability

Solution:
The vendor has released an updated version that addresses this vulnerability. Please see the references for more information.

Canon Network Camera Server Unspecified Cross Site Scripting Vulnerability

References:

• Canon Homepage (Canon)
  
• Canon Network Camera Unspecified Cross Site Scripting Vulnerability (Canon )
  
• JVN#06735665 (JVN)
  
• Update VB100 V3.0 R71 (Canon )
  
• Update VB101 V3.0 R71 (Canon)
  
• Update VB150 V1.1 R41 (Canon)