Re: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
This issue has been resolved in ALL current Netquery downloads at
http://virtech.org/tools/ and, for those who downloaded prior to November 11,
2006, a patch is available at the same location. The following information is
from the README.txt file included in the patch:
________
This patch for Netquery version 4.0 addresses a potential vulnerability issue
originally reported by Zion Security (www.zion-security.com) and subsequently
by others, including SecurityFocus (www.securityfocus.com) and SecurityTracker
(www.securitytracker.com).
To install the patch, simply copy both PHP files (nqSniff.class.php and
sanitize.inc.php) to the include files subfolder of the Netquery module,
overwriting the existing nqSniff.class.php file in that subfolder. There is no
need for any updating of Netquery itself. Nor do any of the module and block
items in any of Netquery's CMS editions require updating.
Contrary to some of the details contained in the reports cited above, the
potential vulnerability affects ALL editions of Netquery as they all use the
same adaptation of Roger Raymond's client sniffer class. As output from that
class has no built-in sanitizing feature, this patch addresses the issue by
including Gavin Zuchlinski's sanitizer functions.
It should be noted that Roger Raymond's client sniffer is a widely used class.
It is used, for example, in various functions of several content management
systems, including both Postnuke and Xaraya. This patch addresses ONLY those
potential vulnerabilities associated with Netquery's uses of its output.
________