Cross-site scripting (XSS) vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows remote attackers to inject arbitrary web script or HTML via a malformed start tag and end tag for a SCRIPT element, as demonstrated by <scr<body>ipt> and </scr<body>ipt> sequences.

Update to latest stable release :

  - Fixes CVE-2010-1677 mhonarc: remote DoS via certain tags

    - Fixes CVE-2010-4524 MHonArc: Improper escaping of       certain HTML sequences (XSS)

    - Fixes dealing with ISO-2022-JP charset.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in MHonArc :

MHonArc 2.6.16 allows remote attackers to cause a denial of service (CPU consumption) via start tags that are placed within other start tags, as demonstrated by a <bo<bo<bo<bo<body>dy>dy>dy>dy> sequence, a different vulnerability than CVE-2010-4524 (CVE-2010-1677).

Cross-site scripting (XSS) vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows remote attackers to inject arbitrary web script or HTML via a malformed start tag and end tag for a SCRIPT element, as demonstrated by <scr<body>ipt> and </scr<body>ipt> sequences (CVE-2010-4524).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest version (2.6.18) which is not vulnerable to these issues.

ID	Name	Product	Family	Severity
52952	Fedora 14 : mhonarc-2.6.18-3.fc14 (2011-3390)	Nessus	Fedora Local Security Checks	medium
52951	Fedora 13 : mhonarc-2.6.18-3.fc13 (2011-3357)	Nessus	Fedora Local Security Checks	medium
52727	Fedora 15 : mhonarc-2.6.18-3.fc15 (2011-3344)	Nessus	Fedora Local Security Checks	medium
51796	Mandriva Linux Security Advisory : MHonArc (MDVSA-2011:003)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-4524

medium

Tenable Plugins

medium

medium

medium

medium