CVE-2007-0706: High severity Fenrir Darksky Rss Bar vulnerability

Q: Which deployments are affected?

Darksky RSS bar for Internet Explorer, RSS bar for Sleipnir, and RSS bar for unDonut are affected when running versions before 1.29.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by supplying RSS data containing certain script. No authentication is required.

Q: What is the practical security impact?

Successful exploitation bypasses Web content zone restrictions and can affect confidentiality, integrity, and availability.

Q: What should be done to remediate the issue?

Update the affected RSS bar software to version 1.29 or later.

Published Feb 4, 2007

Updated

Cross-zone scripting vulnerability in Darksky RSS bar for Internet Explorer before 1.29, RSS bar for Sleipnir before 1.29, and RSS bar for unDonut before 1.29 allows remote attackers to bypass Web content zone restrictions via certain script contained in RSS data. NOTE: some of these details are obtained from third party information.

Affected Software

3 affected components

Fenrir Darksky Rss Bar<=1.28_release3

Event History

Feb 4, 2007

CVE Published

12:28 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

Which deployments are affected?

Darksky RSS bar for Internet Explorer, RSS bar for Sleipnir, and RSS bar for unDonut are affected when running versions before 1.29.

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by supplying RSS data containing certain script. No authentication is required.

What is the practical security impact?

Successful exploitation bypasses Web content zone restrictions and can affect confidentiality, integrity, and availability.

What should be done to remediate the issue?

Update the affected RSS bar software to version 1.29 or later.

CVE-2007-0706: High severity Fenrir Darksky Rss Bar vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the practical security impact?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the practical security impact?

What should be done to remediate the issue?