Release Date: 2004-01-26
Critical: Less critical
Impact: Cross Site Scripting
Where: From remote
Software: IBM Net.Data 7.x
Description:
Secunia has identified a vulnerability in IBM Net.Data, which can be exploited by malicious people to conduct cross-site scripting attacks.
The db2www CGI component returns a "DTWP001E" error message to users when an invalid macro name is supplied. However, user input isn't sanitised before being included, which can be exploited to execute arbitrary HTML or script code in a user's browser session in the context of an affected site.
Other error messages may also be affected.
The vulnerability has been identified in versions 7 and 7.2.
Solution:
The vendor recommends that the "DTW_DEFAULT_ERROR_MESSAGE" feature (or "DTW_DEFAULT_MACRO" feature on zOS and iServer) is used to ensure that a web site reacts in a predictable manner when encountering problems.
Example:
In the Net.Data configuration file "db2www.ini", insert an entry such as:
DTW_DEFAULT_ERROR_MESSAGE
This Web Site is experiencing problems. Check back later.
This will prevent various error messages from being returned to users.
Provided and/or discovered by:
Carsten Eiram, Secunia Research.
Original Advisory:
http://www.secunia.com/secunia_research/2004-1/
Source: Secunia