Symantec SecurityExpressions Audit and Compliance Server Error Message HTML Injection Vulnerability

Bugtraq ID:	36571
Class:	Input Validation Error
CVE:	CVE-2009-3030
Remote:	Yes
Local:	No
Published:	Oct 06 2009 12:00AM
Updated:	Oct 06 2009 07:19PM
Credit:	Nate Roberts with Wipfli, LLP
Vulnerable:	Symantec SecurityExpressions Audit and Compliance Server 4.1.1 Symantec SecurityExpressions Audit and Compliance Server 4.1
Not Vulnerable:	Symantec SecurityExpressions Audit and Compliance Server 4.1.1 Hotfix 1

Symantec SecurityExpressions Audit and Compliance Server Error Message HTML Injection Vulnerability

Symantec SecurityExpressions Audit and Compliance Server is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits would allow an attacker to execute arbitrary script and HTML code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

SecurityExpressions Audit and Compliance Server 4.1.1 and prior are vulnerable.

Symantec SecurityExpressions Audit and Compliance Server Error Message HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Symantec SecurityExpressions Audit and Compliance Server Error Message HTML Injection Vulnerability

Solution:
The vendor has released an update. Please see the references for details.


Symantec SecurityExpressions Audit and Compliance Server 4.1.1

• Symantec seserver-4.1.1-Hot-Fix-1.zip
  https://kb.altiris.com/utility/getfile.asp?rid=6264&aid=49452

Symantec SecurityExpressions Audit and Compliance Server Error Message HTML Injection Vulnerability

References:

• Security Advisories Relating to Symantec Products - Symantec SecurityExpressions (Symantec)
  
• Symantec Homepage (Symantec)