what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

iDEFENSE Security Advisory 2007-08-14.1

Posted Aug 15, 2007

Authored by iDefense Labs, Aviv Raff | Site idefense.com

iDefense Security Advisory 08.14.07 - Remote exploitation of a Cross Site Scripting (XSS) vulnerability in the Windows Vista Sidebar RSS Gadget allows an attacker to execute arbitrary code with the privileges of the logged in user. The vulnerability exists within the parsing of the certain elements of the items in an RSS feed. A properly crafted HTML tag within these elements will not be removed, and will be rendered by the RSS gadget. Since the RSS gadget runs in the local zone, the injected JavaScript has full access to the system. iDefense has confirmed the existence of this vulnerability in Microsoft Windows Vista Business. Other versions are suspected to be vulnerable.

tags | advisory, remote, arbitrary, local, javascript, xss

systems | windows

advisories | CVE-2007-3033

SHA-256 | b72e8982684f82bb2ef8f850fc5b1d27c583c8eb479eac82601e2686a3b3bac8

Download | Favorite | View

Related Files

No related files