CVE-2007-0706: High severity Fenrir Darksky Rss Bar vulnerability
Cross-zone scripting vulnerability in Darksky RSS bar for Internet Explorer before 1.29, RSS bar for Sleipnir before 1.29, and RSS bar for unDonut before 1.29 allows remote attackers to bypass Web content zone restrictions via certain script contained in RSS data. NOTE: some of these details are obtained from third party information.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Darksky RSS bar for Internet Explorer, RSS bar for Sleipnir, and RSS bar for unDonut are affected when running versions before 1.29.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely by supplying RSS data containing certain script. No authentication is required.
What is the practical security impact?
Successful exploitation bypasses Web content zone restrictions and can affect confidentiality, integrity, and availability.
What should be done to remediate the issue?
Update the affected RSS bar software to version 1.29 or later.