1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200502-16 / htdig |
| Release Date | February 13, 2005 |
| Latest Revision | February 13, 2005: 01 |
| Impact | low |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| www-misc/htdig | < 3.1.6-r7 | >= 3.1.6-r7 | All supported architectures |
Related bugreports: #80602
ht://Dig is vulnerable to cross-site scripting attacks.
ht://Dig is an HTTP/HTML indexing and searching system.
Michael Krax discovered that ht://Dig fails to validate the 'config' parameter before displaying an error message containing the parameter. This flaw could allow an attacker to conduct cross-site scripting attacks.
By sending a carefully crafted message, an attacker can inject and execute script code in the victim's browser window. This allows to modify the behaviour of ht://Dig, and/or leak session information such as cookies to the attacker.
There is no known workaround at this time.
All ht://Dig users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=www-misc/htdig-3.1.6-r7" |