VeriSign Kontiki Delivery Management System (DMS) Cross-Site Scripting Vulnerability

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052458 漏洞类型
发布时间 2008-10-05 更新时间 2008-10-05
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2008100017
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
VeriSign Kontiki Delivery Management System (DMS) Cross-Site Scripting
Vulnerability 

(CVE Number: CVE-2008-4393) 


Vulnerability Type / Importance: XSS / Medium 
Problem discovered: September 24th 2007 
Vendor contacted: September 26th 2007 
Advisory published: March 28th 2008 


Abstract 

The Kontiki Delivery Management System (DMS) is "a low-cost enterprise
content delivery system that helps large companies rapidly deliver
compelling, rich media communications to employees, customers, and
partners." 

Kontiki DMS is vulnerable to a cross-site scripting attack based on the
manipulation of URL parameters of a site running this service. 

Description

During a recent penetration test, a cross-site scripting vulnerability
was discovered in a Kontiki DMS servlet. The vulnerability can be tested
by entering JavaScript in the URL as shown in the example below: 

http://server/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.co
okie)%3C/script%3E


The server would process the code and execute the JavaScript on the
user's browser. 

Verisign was contacted and immediately confirmed that this was indeed a
security issue and set about producing a patch to include in the next
update for the product. 

Affected Versions 
Kontiki DMS Version <= 5.0 

Operating Systems Tested 
Microsoft Windows 

Vendor & Patch Information 

Verisign has released a patch to resolve this issue, which can be
downloaded from https://customersupport.kontiki.com/software/patch-20102


Workarounds 

IRM is not aware of any workarounds for this issue. 

 
Credits 

Research & Advisory: Mazin Faour 
 

Disclaimer 

All information in this advisory is provided on an 'as is' basis in the
hope that it will be useful. Information Risk Management Plc is not
responsible for any risks or occurrences caused by the application of
this information.

 
http://www.irmplc.com/researchlab