MyNewsGroups Subject Header HTML Injection Vulnerability

Bugtraq ID:	5836
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 30 2002 12:00AM
Updated:	Sep 30 2002 12:00AM
Credit:	Discovery credited to Ulf Harnhammar.
Vulnerable:	Carlos Sanchez Valle MyNewsGroups :) 0.4.1 Carlos Sanchez Valle MyNewsGroups :) 0.4
Not Vulnerable:

MyNewsGroups Subject Header HTML Injection Vulnerability

It has been reported that the MyNewsGroups news client is prone to HTML injection attacks, in the form of maliciously created news messages.

Exploitation of this issue may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials.

MyNewsGroups Subject Header HTML Injection Vulnerability

Solution:
Ulf Harnhammar of VSU Security has released a patch for v0.4.1 addressing this issue. This third party patch has not been tested.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.


Carlos Sanchez Valle MyNewsGroups :) 0.4.1

• Ulf Harnhammar mynewsgroups.patch
  This is an unofficial patch.
  http://www.securityfocus.com/data/vulnerabilities/patches/mynewsgroups .patch

MyNewsGroups Subject Header HTML Injection Vulnerability

References: