A hand-crafted JSONP callback and response can be used to run arbitrary code inside client-side browsers via Adobe Flash in Apache CouchDB versions up to and including 1.0.3, 1.1.1, and 1.2.0.
5a2dd81bafd715b2feba5ff5376839517a8c160f8e3cf3ca974c5d881e77a6d6
CVE-2012-5649
JSONP arbitrary code execution with Adobe Flash
Severity: Moderate
Vendor: The Apache Software Foundation
Affected Versions:
JSONP is supported but disabled by default in all currently supported
releases of Apache CouchDB. Administrator access is required to enable it.
Releases up to and including 1.0.3, 1.1.1, and 1.2.0 are vulnerable, if
administrators have enabled JSONP.
Description:
A hand-crafted JSONP callback and response can be used to run
arbitrary code inside client-side browsers via Adobe Flash.
Mitigation:
Upgrade to a supported release that includes this fix, such as
CouchDB 1.0.4, 1.1.2, 1.2.1, and the future 1.3.x series, all of which
include a specific fix.
Work-Around:
Disable JSONP.
Jan Lehnardt
--