Debian DSA-1133-1 : mantis - missing input sanitising

critical Nessus Plugin ID 22675

Synopsis

The remote Debian host is missing a security-related update.

Description

Several remote vulnerabilities have been discovered in the Mantis bug tracking system, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2006-0664 A cross-site scripting vulnerability was discovered in config_defaults_inc.php.

- CVE-2006-0665 Cross-site scripting vulnerabilities were discovered in query_store.php and manage_proj_create.php.

- CVE-2006-0841 Multiple cross-site scripting vulnerabilities were discovered in view_all_set.php, manage_user_page.php, view_filters_page.php and proj_doc_delete.php.

- CVE-2006-1577 Multiple cross-site scripting vulnerabilities were discovered in view_all_set.php.

Solution

Upgrade the mantis package.

For the stable distribution (sarge) these problems have been fixed in version 0.19.2-5sarge4.1.

Plugin Details

Severity: Critical

ID: 22675

File Name: debian_DSA-1133.nasl

Version: 1.16

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 10/14/2006

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:mantis, cpe:/o:debian:debian_linux:3.1

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 8/1/2006

Vulnerability Publication Date: 12/23/2005

Reference Information

CVE: CVE-2006-0664, CVE-2006-0665, CVE-2006-0841, CVE-2006-1577

DSA: 1133

Detections

Analytics