September 20, 2004
Mambo open source is reportedly affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly validate user-supplied URI parameters. An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer, to carry out cross-site scripting attacks, and to make SLQ injection attacks against the vulnerable application.
- Mambo Mambo Open Source 4.5.1 (1.0.9)
Block external access at the network boundary, unless external parties require service.
Access to the affected computer should be filtered at the network boundary if global accessibility is not required. Restricting access to only trusted computers and networks might greatly reduce the likelihood of exploitation.
Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy network intrusion detection systems (NIDS) to monitor network traffic for anomalous or suspicious requests, including requests that contain client side script code and SQL syntax. NIDS logs should be audited regularly to detect and respond to possible incidents in a timely manner.
Run all software as a nonprivileged user with minimal access rights.
Running the affected server with the least required privileges by forcing it to drop privileges after acquiring system resources is highly recommended. This may greatly reduce the consequences of successful exploitation.
Use access control lists to enhance security.
Using database access controls to define specific roles for database tasks may limit the impact of a successful attack.
Do not follow links provided by unknown or untrusted sources.
Do not use the client to visit untrusted or unfamiliar servers or to load content that has been supplied by an untrusted source. This will reduce exposure to cross-site scripting issues.
Set web browser security to disable the execution of script code or active content.
As the exploitation of the cross-site scripting issue allows the execution of malicious script code in web clients, it may be possible to prevent successful exploitation by disabling script code and active content support within a client browser. It should be noted that this mitigation tactic might adversely affect websites that rely on the execution of browser based script code.
It has been reported that the current CVS version has been patched against these issues, although this has not been verified. Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: email@example.com <mailto:firstname.lastname@example.org>.
Disclosure of this issue is credited to Joxean Koret <email@example.com> and khoai.
© 1995- Symantec Corporation
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from firstname.lastname@example.org.
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and email@example.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.