BID:7017 - iPlanet Log Analyzer Logfile HTML Injection Vulnerability

iPlanet Log Analyzer Logfile HTML Injection Vulnerability

BID:7017

Info

iPlanet Log Analyzer Logfile HTML Injection Vulnerability

Bugtraq ID:	7017
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 04 2003 12:00AM
Updated:	Mar 04 2003 12:00AM
Credit:	Discovery credited to Hugo "Vázquez" "Caramés" <[email protected]>.
Vulnerable:	Sun iPlanet Web Server 6.0 SP2 Sun iPlanet Web Server 6.0 SP1 Sun iPlanet Web Server 6.0 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows NT 4.0 SP6a - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Sun iPlanet Web Server 4.1 SP9 Sun iPlanet Web Server 4.1 SP8 Sun iPlanet Web Server 4.1 SP7 Sun iPlanet Web Server 4.1 SP6 Sun iPlanet Web Server 4.1 SP5 Sun iPlanet Web Server 4.1 SP4 Sun iPlanet Web Server 4.1 SP3 Sun iPlanet Web Server 4.1 SP2 Sun iPlanet Web Server 4.1 SP12 Sun iPlanet Web Server 4.1 SP11 Sun iPlanet Web Server 4.1 SP10 Sun iPlanet Web Server 4.1 SP1 Sun iPlanet Web Server 4.1 - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition (Windows) 4.1 sp7 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition (Windows) 4.1 sp6 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition (Windows) 4.1 sp5 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition (Windows) 4.1 sp4 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition (Windows) 4.1 sp3 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 6.0 SP2 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 6.0 SP1 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 6.0 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP9 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP8 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP7 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 d - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP6 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 d - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP5 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 d - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP4 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 d - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP3 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 d - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP2 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP11 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP10 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 SP1 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 - Compaq Tru64 5.1 - Compaq Tru64 5.0 a - HP HP-UX 11.0 - HP HP-UX 11i v1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 SP6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 SP5 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 SP4 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 SP3 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 SP2 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 SP1 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 - Compaq Tru64 5.1 - Compaq Tru64 5.0 a - HP HP-UX 11.0 - HP HP-UX 11i v1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6

Not Vulnerable:

Exploit / POC

iPlanet Log Analyzer Logfile HTML Injection Vulnerability

There is no exploit required.

References

iPlanet Log Analyzer Logfile HTML Injection Vulnerability

References:

Log corruption on multiple webservers, log analyzers,... ( Hugo "Vázquez" "Caramés" )