| Description: | Description:
The remote host is missing an update to MHonArc
announced via advisory MDVSA-2011:003.
Multiple vulnerabilities has been found and corrected in MHonArc:
MHonArc 2.6.16 allows remote attackers to cause a denial of service
(CPU consumption) via start tags that are placed within other start
tags, as demonstrated by a dy>dy>dy>dy> sequence,
a different vulnerability than CVE-2010-4524 (CVE-2010-1677).
Cross-site scripting (XSS) vulnerability in lib/mhtxthtml.pl in
MHonArc 2.6.16 allows remote attackers to inject arbitrary web script
or HTML via a malformed start tag and end tag for a SCRIPT element,
as demonstrated by ipt> and ipt> sequences
(CVE-2010-4524).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been upgraded to the latest version (2.6.18)
which is not vulnerable to these issues.
Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:003
Risk factor : Medium
CVSS Score:
5.0
|
