Adobe RoboHelp Server and RoboHelp (CVE-2011-0613) Cross Site Scripting Vulnerability

Bugtraq ID:	47839
Class:	Input Validation Error
CVE:	CVE-2011-0613
Remote:	Yes
Local:	No
Published:	May 12 2011 12:00AM
Updated:	May 12 2011 12:00AM
Credit:	James Jardine of Jardine Software Inc.
Vulnerable:	Adobe RoboHelp Server 8 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Adobe RoboHelp Server 7 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Adobe RoboHelp 8 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Adobe RoboHelp 7 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home
Not Vulnerable:

Adobe RoboHelp Server and RoboHelp (CVE-2011-0613) Cross Site Scripting Vulnerability

Adobe RoboHelp Server and RoboHelp are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Adobe RoboHelp Server and RoboHelp (CVE-2011-0613) Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user into following a malicious URI.

Adobe RoboHelp Server and RoboHelp (CVE-2011-0613) Cross Site Scripting Vulnerability

Solution:
The vendor has released patches. Please see the references for more information.


Adobe RoboHelp Server 8

• Adobe APSB11-09.zip
  http://www.adobe.com/support/security/bulletins/downloads/APSB11-09.zi p

Adobe RoboHelp Server 7

• Adobe APSB11-09.zip
  http://www.adobe.com/support/security/bulletins/downloads/APSB11-09.zi p

Adobe RoboHelp 7

• Adobe APSB11-09.zip
  http://www.adobe.com/support/security/bulletins/downloads/APSB11-09.zi p

Adobe RoboHelp 8

• Adobe APSB11-09.zip
  http://www.adobe.com/support/security/bulletins/downloads/APSB11-09.zi p

Adobe RoboHelp Server and RoboHelp (CVE-2011-0613) Cross Site Scripting Vulnerability

References:

• RoboHelp Server Homepage (Adobe)
  
• Adobe Security Advisory APSB11-09 (Adobe)