Samizdat Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	33768
Class:	Input Validation Error
CVE:	CVE-2009-0359
Remote:	Yes
Local:	No
Published:	Feb 13 2009 12:00AM
Updated:	Feb 13 2009 10:58PM
Credit:	These issues were disclosed by the vendor.
Vulnerable:	Samizdat Samizdat 0.6.1
Not Vulnerable:	Samizdat Samizdat 0.6.2

Samizdat Multiple Cross Site Scripting Vulnerabilities

Samizdat is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Versions prior to Samizdat 0.6.2 are vulnerable.

Samizdat Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Samizdat Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released updates. Please see the references for more information.


Samizdat Samizdat 0.6.1

• Samizdat samizdat-0.6.2.tar.gz
  http://savannah.nongnu.org/download/samizdat/samizdat-0.6.2.tar.gz

Samizdat Multiple Cross Site Scripting Vulnerabilities

References:

• Samidat 0.6.2 (2009-02-12) (Samizdat)
  
• Samizdat Homepage (Samizdat)
  
• Cross-site scripting in Samizdat 0.6.1 (Dmitry Borodaenko )