SB2013041206 - Cross-site scripting in smokeping (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) Cross-site scripting (CVE-ID: CVE-2012-0790)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 when processing displaymode parameter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=6c450cd99f50bc642856c90bc1eb74c65b534e36
• https://git.alpinelinux.org/aports/commit/?id=911da9c164136f7c5f055083082874c5d0c15f19
• https://git.alpinelinux.org/aports/commit/?id=acc5b8b4bbda55488dd0f2a52c08adc0a48847f3