CVE ID:	CVE-2008-0005
Description:	mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
Test IDs:	1.3.6.1.4.1.25623.1.0.60411   1.3.6.1.4.1.25623.1.0.60409
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0005 http://securityreason.com/achievement_securityalert/49 Bugtraq: 20080110 SecurityReason - Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability (Google Search) http://www.securityfocus.com/archive/1/archive/1/486167/100/0/threaded Bugtraq: 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server (Google Search) http://www.securityfocus.com/archive/1/archive/1/505990/100/0/threaded http://lists.vmware.com/pipermail/security-announce/2009/000062.html http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html http://security.gentoo.org/glsa/glsa-200803-19.xml HPdes Security Advisory: HPSBUX02431 http://marc.info/?l=bugtraq&m=124654546101607&w=2 HPdes Security Advisory: SSRT090085 http://marc.info/?l=bugtraq&m=124654546101607&w=2 HPdes Security Advisory: HPSBUX02465 http://marc.info/?l=bugtraq&m=125631037611762&w=2 HPdes Security Advisory: SSRT090192 http://marc.info/?l=bugtraq&m=125631037611762&w=2 HPdes Security Advisory: HPSBOV02683 http://marc.info/?l=bugtraq&m=130497311408250&w=2 HPdes Security Advisory: SSRT090208 http://marc.info/?l=bugtraq&m=130497311408250&w=2 http://www.mandriva.com/security/advisories?name=MDVSA-2008:014 http://www.mandriva.com/security/advisories?name=MDVSA-2008:015 http://www.mandriva.com/security/advisories?name=MDVSA-2008:016 RedHat Security Advisories: RHSA-2008:0004 http://www.redhat.com/support/errata/RHSA-2008-0004.html RedHat Security Advisories: RHSA-2008:0005 http://www.redhat.com/support/errata/RHSA-2008-0005.html RedHat Security Advisories: RHSA-2008:0006 http://www.redhat.com/support/errata/RHSA-2008-0006.html RedHat Security Advisories: RHSA-2008:0007 http://www.redhat.com/support/errata/RHSA-2008-0007.html RedHat Security Advisories: RHSA-2008:0008 http://www.redhat.com/support/errata/RHSA-2008-0008.html RedHat Security Advisories: RHSA-2008:0009 http://www.redhat.com/support/errata/RHSA-2008-0009.html SuSE Security Announcement: SUSE-SA:2008:021 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html http://www.ubuntu.com/usn/usn-575-1 BugTraq ID: 27234 http://www.securityfocus.com/bid/27234 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10812 http://secunia.com/advisories/35650 http://www.vupen.com/english/advisories/2008/0924/references http://www.vupen.com/english/advisories/2008/1875/references http://www.securitytracker.com/id?1019185 http://secunia.com/advisories/28467 http://secunia.com/advisories/28471 http://secunia.com/advisories/28526 http://secunia.com/advisories/28607 http://secunia.com/advisories/28749 http://secunia.com/advisories/28977 http://secunia.com/advisories/29348 http://secunia.com/advisories/29420 http://secunia.com/advisories/29640 http://secunia.com/advisories/30732 http://securityreason.com/securityalert/3526 XForce ISS Database: apache-modproxyftp-utf7-xss(39615) http://xforce.iss.net/xforce/xfdb/39615

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: