Debian man2html CVE-2011-2770 Cross Site Scripting Vulnerability

Bugtraq ID:	50566
Class:	Input Validation Error
CVE:	CVE-2011-2770
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Nov 07 2011 12:00AM
Credit:	Tim Starling
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Debian man2html CVE-2011-2770 Cross Site Scripting Vulnerability

Debian man2html is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Debian man2html CVE-2011-2770 Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Debian man2html CVE-2011-2770 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Debian man2html CVE-2011-2770 Cross Site Scripting Vulnerability

References:

• Debian man2html Download (Debian)
  
• [DSA 2335-1] man2html security update (Tim Starling)