Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.

Update to 0.10.5 to fix two non-critical security issues:
CVE-2008-2951: Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL in the q parameter. CVE-2008-3328: Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Trac, an enhanced wiki and issue tracking system for software development projects. 

The version of Trac installed on the remote host fails to sanitize user input to the 'q' parameter of the 'search' script before using it in an unfiltered and unmanaged fashion in a redirect.  An attacker may be able to use an open redirect such as this to trick people into visiting malicious sites, which could lead to phising attacks, browser exploits, or drive-by malware downloads.

ID	Name	Product	Family	Severity
33767	Fedora 9 : trac-0.10.5-1.fc9 (2008-6833)	Nessus	Fedora Local Security Checks	medium
33766	Fedora 8 : trac-0.10.5-1.fc8 (2008-6830)	Nessus	Fedora Local Security Checks	medium
33271	Trac quickjump Search Script q Parameter Arbitrary Site Redirect	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2008-2951

medium

Tenable Plugins

medium

medium

medium