Interchange Search Request Information Disclosure Vulnerability

Bugtraq ID:	36452
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 18 2009 12:00AM
Updated:	Sep 18 2009 10:30PM
Credit:	Mark Lipscombe
Vulnerable:	Interchange Interchange 5.7.1 Interchange Interchange 5.6.1 Interchange Interchange 5.5.2 Interchange Interchange 5.5.1 Interchange Interchange 5.4.3 Interchange Interchange 5.4.2 Interchange Interchange 5.4.1 Interchange Interchange 5.2.1 Interchange Interchange 5.2 Interchange Interchange 5.0.2 Interchange Interchange 5.0.1 Interchange Interchange 5.0 Interchange Interchange 4.8.9 Interchange Interchange 4.8.8 Interchange Interchange 4.8.7 Interchange Interchange 4.8.6 Interchange Interchange 4.8.5 Interchange Interchange 4.8.4 Interchange Interchange 4.8.3 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Interchange Interchange 4.8.2 Interchange Interchange 4.8.1 Interchange Interchange 5.6
Not Vulnerable:	Interchange Interchange 5.7.2 Interchange Interchange 5.6.2 Interchange Interchange 5.4.4

Interchange Search Request Information Disclosure Vulnerability

Interchange is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to harvest sensitive information that may aid in further attacks.

Versions prior to the following are vulnerable:

Interchange 5.4.4
Interchange 5.6.2
Interchange 5.7.2

Interchange Search Request Information Disclosure Vulnerability

Attackers can exploit this issue using a web browser.

Interchange Search Request Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.


Interchange Interchange 5.6

• Interchange interchange-5.6.2.tar.gz
  http://ftp.icdevgroup.org/interchange/5.6/tar/interchange-5.6.2.tar.gz

Interchange Interchange 5.4.1

• Interchange interchange-5.4.4.tar.gz
  http://ftp.icdevgroup.org/interchange/5.4/tar/interchange-5.4.4.tar.gz

Interchange Interchange 5.4.2

• Interchange interchange-5.4.4.tar.gz
  http://ftp.icdevgroup.org/interchange/5.4/tar/interchange-5.4.4.tar.gz

Interchange Interchange 5.4.3

• Interchange interchange-5.4.4.tar.gz
  http://ftp.icdevgroup.org/interchange/5.4/tar/interchange-5.4.4.tar.gz

Interchange Interchange 5.6.1

• Interchange interchange-5.6.2.tar.gz
  http://ftp.icdevgroup.org/interchange/5.6/tar/interchange-5.6.2.tar.gz

Interchange Interchange 5.7.1

• Interchange interchange-5.7.2.tar.gz
  http://ftp.icdevgroup.org/interchange/5.7/tar/interchange-5.7.2.tar.gz

Interchange Search Request Information Disclosure Vulnerability

References:

• Interchange Homepage (Interchange)
  
• Interchange security releases: 5.7.2, 5.6.2, 5.4.4 (Jon Jensen)
  
• Interchange security releases: 5.7.2, 5.6.2, 5.4.4 (Jon Jensen)