Avant Browser Ultimate Security Bypass and Multiple HTML-injection vulnerabilities

Bugtraq ID:	56851
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 03 2012 12:00AM
Updated:	Dec 03 2012 12:00AM
Credit:	Roberto Suggi Liverani
Vulnerable:	Avant Force Avant Browser Ultimate 2012 Build 28
Not Vulnerable:

Avant Browser Ultimate Security Bypass and Multiple HTML-injection vulnerabilities

Avant Browser Ultimate is prone to security-bypass vulnerability and multiple HTML-injection vulnerabilities.

An attacker can exploit these issues to execute arbitrary script code within the context of the browser, steal cookie-based authentication credentials, bypass certain security restrictions, and perform unauthorized actions within the context of the webserver.

Avant Browser Ultimate 2012 Build 28 is vulnerable; other versions may also be affected.

Avant Browser Ultimate Security Bypass and Multiple HTML-injection vulnerabilities

Exploits are available, please see the reference for more information.

Avant Browser Ultimate Security Bypass and Multiple HTML-injection vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Avant Browser Ultimate Security Bypass and Multiple HTML-injection vulnerabilities

References:

• Avant Browser HomePage (Avant Force)
  
• Multiple critical vulnerabilities in Maxthon and Avant browsers (Fulldisclosure)
  
• Vulnerability Advisory (Security-Assessment.com)