Juniper Networks
Solutions
Products & Services
Company
Partners
Support
Education

Signature Detail

Security Intelligence Center
Signatures
Print

Short Name

 HTTP:XSS:HTML-SCRIPT-IN-URL-PTH

Severity

 High

Recommended

 No

Category

 HTTP

Keywords

 HTML Script Tag Embedded in URL Path

Release Date

 2003/10/08

Update Number

 1213

Supported Platforms

 di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+

HTTP: HTML Script Tag Embedded in URL Path


This signature detects attempts at cross-site scripting attacks. Attackers can create a malicious Web site that includes HTML embedded in the hyperlinks, which can violate site security settings.

Extended Description

The Apache 'mod_proxy_ftp' module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. This issue is reported to affect Apache 2.0.63 and 2.2.9; other versions may also be affected.

Affected Products

  • Apache Software Foundation Apache 2.0.35
  • Apache Software Foundation Apache 2.0.36
  • Apache Software Foundation Apache 2.0.37
  • Apache Software Foundation Apache 2.0.38
  • Apache Software Foundation Apache 2.0.39
  • Apache Software Foundation Apache 2.0.40
  • Apache Software Foundation Apache 2.0.41
  • Apache Software Foundation Apache 2.0.42
  • Apache Software Foundation Apache 2.0.43
  • Apache Software Foundation Apache 2.0.44
  • Apache Software Foundation Apache 2.0.45
  • Apache Software Foundation Apache 2.0.46
  • Apache Software Foundation Apache 2.0.47
  • Apache Software Foundation Apache 2.0.48
  • Apache Software Foundation Apache 2.0.49
  • Apache Software Foundation Apache 2.0.50
  • Apache Software Foundation Apache 2.0.51
  • Apache Software Foundation Apache 2.0.52
  • Apache Software Foundation Apache 2.0.53
  • Apache Software Foundation Apache 2.0.54
  • Apache Software Foundation Apache 2.0.55
  • Apache Software Foundation Apache 2.0.56 -Dev
  • Apache Software Foundation Apache 2.0.57
  • Apache Software Foundation Apache 2.0.58
  • Apache Software Foundation Apache 2.0.59
  • Apache Software Foundation Apache 2.0.60-Dev
  • Apache Software Foundation Apache 2.0.61-Dev
  • Apache Software Foundation Apache 2.0.62-Dev
  • Apache Software Foundation Apache 2.0.63
  • Apache Software Foundation Apache 2.2.9
  • Apple Mac OS X 10.4.0
  • Apple Mac OS X 10.4.1
  • Apple Mac OS X 10.4.10
  • Apple Mac OS X 10.4.11
  • Apple Mac OS X 10.4.2
  • Apple Mac OS X 10.4.3
  • Apple Mac OS X 10.4.4
  • Apple Mac OS X 10.4.5
  • Apple Mac OS X 10.4.6
  • Apple Mac OS X 10.4.7
  • Apple Mac OS X 10.4.8
  • Apple Mac OS X 10.4.9
  • Apple Mac OS X 10.5
  • Apple Mac OS X 10.5.1
  • Apple Mac OS X 10.5.2
  • Apple Mac OS X 10.5.3
  • Apple Mac OS X 10.5.4
  • Apple Mac OS X 10.5.5
  • Apple Mac OS X 10.5.6
  • Blue Coat Systems Director 4.2.2.4
  • Blue Coat Systems Director 5.2.2.5
  • Blue Coat Systems Director 5.4
  • Blue Coat Systems Director 5.5
  • Blue Coat Systems Director
  • HP Business Availability Center 8.01
  • HP HP-UX B.11.11
  • HP HP-UX B.11.23
  • HP HP-UX B.11.31
  • IBM HTTP Server 2.0.47
  • IBM HTTP Server 2.0.47 .1
  • IBM HTTP Server 6.0.2
  • IBM HTTP Server 6.0.2.12
  • IBM HTTP Server 6.0.2.13
  • IBM HTTP Server 6.0.2.19
  • IBM HTTP Server 6.0.2.23
  • IBM HTTP Server 6.0.2.27
  • IBM Websphere Application Server 6.1.0
  • IBM Websphere Application Server 6.1.0.1
  • IBM Websphere Application Server 6.1.0.10
  • IBM Websphere Application Server 6.1.0.11
  • IBM Websphere Application Server 6.1.0.12
  • IBM Websphere Application Server 6.1.0.13
  • IBM Websphere Application Server 6.1.0.14
  • IBM Websphere Application Server 6.1.0.15
  • IBM Websphere Application Server 6.1.0.17
  • IBM Websphere Application Server 6.1.0.18
  • IBM Websphere Application Server 6.1.0.19
  • IBM Websphere Application Server 6.1.0.2
  • IBM Websphere Application Server 6.1.0.20
  • IBM Websphere Application Server 6.1.0.3
  • IBM Websphere Application Server 6.1.0.4
  • IBM Websphere Application Server 6.1.0.5
  • IBM Websphere Application Server 6.1.0.6
  • IBM Websphere Application Server 6.1.0.7
  • IBM Websphere Application Server 6.1.0.8
  • IBM Websphere Application Server 6.1.0.9
  • Mandriva Corporate Server 3.0.0
  • Mandriva Corporate Server 3.0.0 X86 64
  • Mandriva Corporate Server 4.0
  • Mandriva Corporate Server 4.0.0 X86 64
  • Mandriva Linux Mandrake 2007.1
  • Mandriva Linux Mandrake 2007.1 X86 64
  • Mandriva Linux Mandrake 2008.0
  • Mandriva Linux Mandrake 2008.0 X86 64
  • Mandriva Linux Mandrake 2008.1
  • Mandriva Linux Mandrake 2008.1 X86 64
  • Mandriva Linux Mandrake 2009.0
  • Mandriva Linux Mandrake 2009.0 X86 64
  • Mandriva Linux Mandrake 2009.1
  • Mandriva Linux Mandrake 2009.1 X86 64
  • Mandriva Multi Network Firewall 2.0.0
  • Pardus Linux 2007
  • Pardus Linux 2008
  • Red Hat Application Stack v2
  • Red Hat Certificate Server 7.3
  • Red Hat Desktop 3.0.0
  • Red Hat Desktop 4.0.0
  • Red Hat Enterprise Linux 5 Server
  • Red Hat Enterprise Linux AS 3
  • Red Hat Enterprise Linux AS 4
  • Red Hat Enterprise Linux Desktop 5 Client
  • Red Hat Enterprise Linux Desktop Workstation 5 Client
  • Red Hat Enterprise Linux ES 3
  • Red Hat Enterprise Linux ES 4
  • Red Hat Enterprise Linux WS 3
  • Red Hat Enterprise Linux WS 4
  • rPath Appliance Platform Linux Service 1
  • rPath Appliance Platform Linux Service 2
  • rPath rPath Linux 1
  • rPath rPath Linux 2
  • Sun Solaris 10 Sparc
  • Sun Solaris 10 X86
  • SuSE Novell Linux Desktop 9.0.0
  • SuSE Novell Linux POS 9
  • SuSE Open-Enterprise-Server 9.0.0
  • SuSE openSUSE 10.2
  • SuSE openSUSE 10.3
  • SuSE openSUSE 11.0
  • SuSE SUSE Linux Enterprise Desktop 10
  • SuSE SUSE Linux Enterprise Desktop 10 SP1
  • SuSE SUSE Linux Enterprise Desktop 10 SP2
  • SuSE SUSE Linux Enterprise Server 10
  • SuSE SUSE Linux Enterprise Server 9
  • Turbolinux Appliance Server 2.0
  • Turbolinux Client 2008
  • Turbolinux FUJI
  • Turbolinux Multimedia
  • Turbolinux Personal
  • Turbolinux Turbolinux Server 10.0.0
  • Turbolinux Turbolinux Server 10.0.0 X64
  • Turbolinux Turbolinux Server 11
  • Turbolinux Turbolinux Server 11 X64
  • Ubuntu Ubuntu Linux 6.06 LTS Amd64
  • Ubuntu Ubuntu Linux 6.06 LTS I386
  • Ubuntu Ubuntu Linux 6.06 LTS Powerpc
  • Ubuntu Ubuntu Linux 6.06 LTS Sparc
  • Ubuntu Ubuntu Linux 7.10 Amd64
  • Ubuntu Ubuntu Linux 7.10 I386
  • Ubuntu Ubuntu Linux 7.10 Lpia
  • Ubuntu Ubuntu Linux 7.10 Powerpc
  • Ubuntu Ubuntu Linux 7.10 Sparc
  • Ubuntu Ubuntu Linux 8.04 LTS Amd64
  • Ubuntu Ubuntu Linux 8.04 LTS I386
  • Ubuntu Ubuntu Linux 8.04 LTS Lpia
  • Ubuntu Ubuntu Linux 8.04 LTS Powerpc
  • Ubuntu Ubuntu Linux 8.04 LTS Sparc

References

  • BugTraq: 29103
  • BugTraq: 66788
  • CERT: CA-2000-02
  • CVE: CVE-2007-2581
  • CVE: CVE-2013-3908
  • CVE: CVE-2008-2123
  • CVE: CVE-2008-2939
  • CVE: CVE-2007-5923
  • CVE: CVE-2015-6099
  • CVE: CVE-2007-6203
  • CVE: CVE-2015-1636
  • CVE: CVE-2014-2856

Site Map
RSS Feeds
Careers
Accessibility
Feedback
Privacy Policy
Legal Notices
Copyright © 1999-2010 Juniper Networks, Inc. All rights reserved.
Help
|
My Account
|
Log Out