Netscape/iPlanet 404 Document Cross-site Scripting Vulnerability
BID:4439
Info
Netscape/iPlanet 404 Document Cross-site Scripting Vulnerability
| Bugtraq ID: | 4439 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2002 12:00AM |
| Updated: | Apr 04 2002 12:00AM |
| Credit: | Vulnerability announced by CERT. |
| Vulnerable: |
Netscape Enterprise Server 3.51 Netscape Enterprise Server 3.6 SP3 Netscape Enterprise Server 3.6 SP2 Netscape Enterprise Server 3.6 SP1 Netscape Enterprise Server 3.6 Netscape Enterprise Server 3.5 Netscape Enterprise Server 3.4 Netscape Enterprise Server 3.3 Netscape Enterprise Server 3.2 Netscape Enterprise Server 3.1 Netscape Enterprise Server 3.0 Netscape Enterprise Server 2.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 |
| Not Vulnerable: | |
Discussion
Netscape/iPlanet 404 Document Cross-site Scripting Vulnerability
iPlanet is the commercially available web server distributed by iPlanet. It is available for the Unix and Microsoft Windows platforms.
Under some circumstances, it is possible for an attacker to execute script code in browsers that visit a vulnerable server. A link to a non-existing page on a vulnerable web server, with the script code embedded in the URL, could be executed in the browser of the victim. This is due to the response generated by the server.
iPlanet is the commercially available web server distributed by iPlanet. It is available for the Unix and Microsoft Windows platforms.
Under some circumstances, it is possible for an attacker to execute script code in browsers that visit a vulnerable server. A link to a non-existing page on a vulnerable web server, with the script code embedded in the URL, could be executed in the browser of the victim. This is due to the response generated by the server.
Solution / Fix
Netscape/iPlanet 404 Document Cross-site Scripting Vulnerability
Solution:
The following solution has been offered by iPlanet:
Using the Administration Server user interface:
Perform the following steps:
1. Select a server instance to manage.
2. Select Error Responses from the left panel
3. Select Editing: The entire server
4. For Error Code: Not Found, set "File:" to point at a static html file containing the proper response.
Manually modifying the configuration:
Add the following line to the default object, substituting the absolute path to your error response file:
Error fn="send-error" reason="Not Found" path="c:/netscape/server4/docs/errors/notfound.html"
Solution:
The following solution has been offered by iPlanet:
Using the Administration Server user interface:
Perform the following steps:
1. Select a server instance to manage.
2. Select Error Responses from the left panel
3. Select Editing: The entire server
4. For Error Code: Not Found, set "File:" to point at a static html file containing the proper response.
Manually modifying the configuration:
Add the following line to the default object, substituting the absolute path to your error response file:
Error fn="send-error" reason="Not Found" path="c:/netscape/server4/docs/errors/notfound.html"
References
Netscape/iPlanet 404 Document Cross-site Scripting Vulnerability
References:
References:
- Cross Web Site Scripting Vulnerability (iPlanet)