Home / exploits verisign-xss.txt
Posted on 06 October 2008
VeriSign Kontiki Delivery Management System (DMS) Cross-Site Scripting Vulnerability (CVE Number: CVE-2008-4393) Vulnerability Type / Importance: XSS / Medium Problem discovered: September 24th 2007 Vendor contacted: September 26th 2007 Advisory published: March 28th 2008 Abstract The Kontiki Delivery Management System (DMS) is "a low-cost enterprise content delivery system that helps large companies rapidly deliver compelling, rich media communications to employees, customers, and partners." Kontiki DMS is vulnerable to a cross-site scripting attack based on the manipulation of URL parameters of a site running this service. Description During a recent penetration test, a cross-site scripting vulnerability was discovered in a Kontiki DMS servlet. The vulnerability can be tested by entering JavaScript in the URL as shown in the example below: http://server/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.co okie)%3C/script%3E The server would process the code and execute the JavaScript on the user's browser. Verisign was contacted and immediately confirmed that this was indeed a security issue and set about producing a patch to include in the next update for the product. Affected Versions Kontiki DMS Version <= 5.0 Operating Systems Tested Microsoft Windows Vendor & Patch Information Verisign has released a patch to resolve this issue, which can be downloaded from https://customersupport.kontiki.com/software/patch-20102 Workarounds IRM is not aware of any workarounds for this issue. Credits Research & Advisory: Mazin Faour Disclaimer All information in this advisory is provided on an 'as is' basis in the hope that it will be useful. Information Risk Management Plc is not responsible for any risks or occurrences caused by the application of this information. http://www.irmplc.com/researchlab
