CVE-2005-3757
First published: Tue Nov 22 2005(Updated: )
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class methods in select attribute of xsl:value-of tags in XSLT style sheets, such as (1) system-property, (2) sys:getProperty, and (3) run:exec.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Search Appliance | ||
| Google Search Appliance Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://metasploit.com/research/vulns/google_proxystylesheet/
- http://www.securityfocus.com/bid/15509
- http://www.osvdb.org/20981
- http://securitytracker.com/id?1015246
- http://secunia.com/advisories/17644
- http://www.vupen.com/english/advisories/2005/2500
- http://www.securityfocus.com/archive/1/417310/30/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3757?
The severity of CVE-2005-3757 is considered critical due to potential remote code execution and information disclosure vulnerabilities.
How do I fix CVE-2005-3757?
To fix CVE-2005-3757, ensure that you update the Google Mini Search Appliance or Google Search Appliance to the latest security patch provided by Google.
What software is affected by CVE-2005-3757?
CVE-2005-3757 affects the Google Mini Search Appliance and Google Search Appliance.
What type of attack can be executed through CVE-2005-3757?
CVE-2005-3757 allows remote attackers to execute arbitrary code by exploiting vulnerable XSLT style sheets.
Is authentication required to exploit CVE-2005-3757?
No authentication is required to exploit CVE-2005-3757, allowing unauthenticated remote attackers to access the vulnerability.
- agent/softwarecombine
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- vendor/google
- product/mini search appliance
- canonical/google mini search appliance
- product/search appliance
- canonical/google search appliance
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/google search appliance software