SonicWALL Content Filtering错误页面跨站脚本漏洞

漏洞信息详情

SonicWALL Content Filtering错误页面跨站脚本漏洞

CNNVD编号：CNNVD-200811-057
危害等级：中危-->
危害等级：中危
CVE编号： CVE-2008-4918
漏洞类型：跨站脚本
发布时间： 2008-10-30
威胁类型：远程
更新时间： 2009-04-30
厂商： sonicwall
漏洞来源： Adrian Pastor※ m12...

漏洞简介

SonicWall内容过滤软件是一款URL内容过滤解决方案。

如果SonicWall的内容过滤规则阻断了用户访问站点的请求的话，就会向用户显示一个默认的错误页面。由于没有正确地执行过滤，攻击者可以创建特制的URL触发错误并在错误页面中注入恶意脚本。浏览器无法区分内容是来自所请求的站点还是设备，因此会导致在目标域的环境中注入脚本，并在用户查看错误页面时执行。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

SonicWALL

---------

http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdf

参考网址

来源: XF

名称: sonicwall-error-xss(46232)

链接:http://xforce.iss.net/xforce/xfdb/46232

来源: XF

名称: sonicwall-error-xss(46232)

链接:http://xforce.iss.net/xforce/xfdb/46232

来源: MISC

链接:http://www.zerodayinitiative.com/advisories/ZDI-08-070/

来源: MISC

链接:http://www.zerodayinitiative.com/advisories/ZDI-08-070

来源: www.sonicwall.com

链接:http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdf

来源: BID

名称: 31998

链接:http://www.securityfocus.com/bid/31998

来源: BUGTRAQ

名称: 20081105 Re: Re: Re: [Full-disclosure] Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

链接:http://www.securityfocus.com/archive/1/archive/1/498073/100/0/threaded

来源: BUGTRAQ

名称: 20081104 Re: Re: [Full-disclosure] Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

链接:http://www.securityfocus.com/archive/1/archive/1/498043/100/0/threaded

来源: BUGTRAQ

名称: 20081101 Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

链接:http://www.securityfocus.com/archive/1/archive/1/497989/100/0/threaded

来源: BUGTRAQ

名称: 20081031 Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

链接:http://www.securityfocus.com/archive/1/archive/1/497968/100/0/threaded

来源: BUGTRAQ

名称: 20081031 Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

链接:http://www.securityfocus.com/archive/1/archive/1/497958/100/0/threaded

来源: BUGTRAQ

名称: 20081030 ZDI-08-070: SonicWALL Content-Filtering Universal Script Injection Vulnerability

链接:http://www.securityfocus.com/archive/1/archive/1/497948/100/0/threaded

来源: MISC

链接:http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/

来源: VUPEN

名称: ADV-2008-2970

链接:http://www.frsirt.com/english/advisories/2008/2970

来源: SREASON

名称: 4556

链接:http://securityreason.com/securityalert/4556

来源: SECUNIA

名称: 32498

链接:http://secunia.com/advisories/32498

受影响实体

Sonicwall Sonicos:4.0:Unknown:Enhanced

补丁

暂无

正文

SonicWALL Content Filtering错误页面跨站脚本漏洞

漏洞信息详情