This update fixes a cross-site scripting vulnerability that can be exploited remotely. (CVE-2005-0085)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:090 advisory.

  - security flaw (CVE-2005-0085)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Michael Krax reports a vulnerability within htdig. The vulnerability lies within an unsanitized config parameter, allowing a malicious attacker to execute arbitrary scripting code on the target's browser.
This might allow the attacker to obtain the user's cookies which are associated with the site, including cookies used for authentication.

リモートホストは、詳細不明なクロスサイトスクリプティング攻撃に脆弱なht: //Digを実行しています。攻撃者がこの欠陥を悪用して、疑いを持たないユーザーから情報を盗む可能性があります。

Michael Krax discovered a cross site scripting vulnerability in ht://dig, a web search system for an intranet or small internet.

The remote host is running a version of ht://Dig which is vulnerable to an unspecified cross-site scripting attack. An attacker can exploit this flaw to steal information from unsuspecting users.

A cross-site scripting vulnerability in ht://dig was discovered by Michael Krax. The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200502-16 (ht://Dig: XSS vulnerability)

    Michael Krax discovered that ht://Dig fails to validate the     'config' parameter before displaying an error message containing the     parameter. This flaw could allow an attacker to conduct cross-site     scripting attacks.
  Impact :

    By sending a carefully crafted message, an attacker can inject and     execute script code in the victim's browser window. This allows to     modify the behaviour of ht://Dig, and/or leak session information such     as cookies to the attacker.
  Workaround :

    There is no known workaround at this time.

远程主机正在运行 ht: //Dig 的某个版本，该版本容易受到不明跨站脚本攻击。攻击者可利用此缺陷，从毫无防范的用户那里窃取信息。

遠端主機正在執行的 ht: //Dig 版本容易遭受不明的跨網站指令碼攻擊。攻擊者可利用此缺陷，從不知情的使用者處竊取資訊。

The remote version of htsearch appears to be vulnerable to a remote Cross-Site Scripting (XSS) attack. An attacker exploiting this flaw would need to be able to entice a user into clicking on a malicious URL that would contain embedded script code designed to exploit trust and execute within the client browser.

ID	名稱	產品	系列	已發布	已更新	嚴重性
41345	SuSE9 Security Update : htdig (YOU Patch Number 9833)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
17182	RHEL 4 : htdig (RHSA-2005:090)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/4/27	medium
21443	FreeBSD : htdig -- XSS vulnerability (673aec6f-1cae-11da-bc01-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	medium
16317	ht: //Dig htsearch.cgiのconfigパラメーターのXSS	Nessus	CGI abuses : XSS	2005/2/8	2021/1/19	medium
16391	Debian DSA-680-1 : htdig - unsanitised input	Nessus	Debian Local Security Checks	2005/2/14	2021/1/4	medium
16317	ht://Dig htsearch.cgi config Parameter XSS	Nessus	CGI abuses : XSS	2005/2/8	2021/1/19	medium
17669	Mandrake Linux Security Advisory : htdig (MDKSA-2005:063)	Nessus	Mandriva Local Security Checks	2005/4/1	2021/1/6	medium
16453	GLSA-200502-16 : ht://Dig: XSS vulnerability	Nessus	Gentoo Local Security Checks	2005/2/14	2021/1/6	medium
16317	ht: //Dig htsearch.cgi config 参数 XSS	Nessus	CGI abuses : XSS	2005/2/8	2021/1/19	medium
16317	ht: //Dig htsearch.cgi config 參數 XSS	Nessus	CGI abuses : XSS	2005/2/8	2021/1/19	medium
2592	ht://Dig config Parameter XSS	Nessus Network Monitor	CGI	2005/2/4	2019/3/6	low

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low