Secunia Advisory: SA10709
Release Date: 2004-01-26

Critical: Less critical
Impact: Cross Site Scripting
Where: From remote

Software: IBM Net.Data 7.x


Description:
Secunia has identified a vulnerability in IBM Net.Data, which can be exploited by malicious people to conduct cross-site scripting attacks.

The db2www CGI component returns a "DTWP001E" error message to users when an invalid macro name is supplied. However, user input isn't sanitised before being included, which can be exploited to execute arbitrary HTML or script code in a user's browser session in the context of an affected site.

Other error messages may also be affected.

The vulnerability has been identified in versions 7 and 7.2.

Solution:
The vendor recommends that the "DTW_DEFAULT_ERROR_MESSAGE" feature (or "DTW_DEFAULT_MACRO" feature on zOS and iServer) is used to ensure that a web site reacts in a predictable manner when encountering problems.

Example:
In the Net.Data configuration file "db2www.ini", insert an entry such as:

DTW_DEFAULT_ERROR_MESSAGE

This Web Site is experiencing problems. Check back later. 

This will prevent various error messages from being returned to users.

Provided and/or discovered by:
Carsten Eiram, Secunia Research.

Original Advisory:
http://www.secunia.com/secunia_research/2004-1/

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News