Endian Firewall Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	27758
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 12 2008 12:00AM
Updated:	Feb 13 2008 06:26PM
Credit:	syniack <[email protected]> disclosed these issues.
Vulnerable:	Endian Firewall 2.1.2
Not Vulnerable:

Endian Firewall Multiple Cross-Site Scripting Vulnerabilities

Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Attackers can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help attackers steal cookie-based authentication credentials and launch other attacks.

Endian Firewall 2.1.2 is vulnerable to these issues; other versions may also be affected.

Endian Firewall Multiple Cross-Site Scripting Vulnerabilities

An attacker must entice an unsuspecting victim into following a malicious URI to exploit these issues.

Endian Firewall Multiple Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Endian Firewall Multiple Cross-Site Scripting Vulnerabilities

References:

• Endian Firewall Homepage (Endian)