[security-alerts] FW: [SA27906] Apache HTTP Method Request Entity Too Large Cross-Site Scripting

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
> TITLE:
> Apache HTTP Method Request Entity Too Large Cross-Site Scripting
>
> SECUNIA ADVISORY ID:
> SA27906
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/27906/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Cross Site Scripting
>
> WHERE:
> From remote
>
> SOFTWARE:
> Apache 2.0.x
> http://secunia.com/product/73/
> Apache 2.2.x
> http://secunia.com/product/9633/
>
> DESCRIPTION:
> Adrian Pastor and Amir Azam have discovered a vulnerability in
> Apache, which can be exploited by malicious people to conduct
> cross-site scripting attacks.
>
> Input passed via the HTTP method is not properly sanitised before
> being returned to the user when displaying a "413 Request Entity Too
> Large" error page. This can be exploited to execute arbitrary HTML
> and script code in a user's browser session in context of an affected
> site.
>
> The vulnerability is confirmed in version 2.2.4 and reported in
> versions 2.0.46, 2.0.51, 2.0.55, 2.0.59, and 2.2.3. Other versions
> may also be affected.
>
> NOTE: Exploiting the vulnerability might be dependent on the Flash
> player version installed on the target machine.
>
> For more information:
> SA21172
>
> SOLUTION:
> Do not browse untrusted websites or follow untrusted links.
>
> PROVIDED AND/OR DISCOVERED BY:
> Adrian Pastor and Amir Azam, ProCheckUp
>
> ORIGINAL ADVISORY:
> http://procheckup.com/Vulnerability_PR07-37.php
>
> OTHER REFERENCES:
> SA21172:
> http://secunia.com/advisories/21172/
>