Symantec SecurityExpressions Audit and Compliance Server Cross Site Scripting Vulnerability

Bugtraq ID:	36570
Class:	Input Validation Error
CVE:	CVE-2009-3029
Remote:	Yes
Local:	No
Published:	Oct 06 2009 12:00AM
Updated:	Oct 07 2009 08:09PM
Credit:	Nate Roberts with Wipfli, LLP
Vulnerable:	Symantec SecurityExpressions Audit and Compliance Server 4.1.1 Symantec SecurityExpressions Audit and Compliance Server 4.1
Not Vulnerable:	Symantec SecurityExpressions Audit and Compliance Server 4.1.1 Hotfix 1

Symantec SecurityExpressions Audit and Compliance Server Cross Site Scripting Vulnerability

Symantec SecurityExpressions Audit and Compliance Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SecurityExpressions Audit and Compliance Server 4.1.1 and prior are vulnerable.

Symantec SecurityExpressions Audit and Compliance Server Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Symantec SecurityExpressions Audit and Compliance Server Cross Site Scripting Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Symantec SecurityExpressions Audit and Compliance Server 4.1.1

• Symantec seserver-4.1.1-Hot-Fix-1.zip
  https://kb.altiris.com/utility/getfile.asp?rid=6264&aid=49452

Symantec SecurityExpressions Audit and Compliance Server Cross Site Scripting Vulnerability

References:

• Security Advisories Relating to Symantec Products - Symantec SecurityExpressions (Symantec)
  
• Symantec Homepage (Symantec)