Hi, 
we received this from vendor-sec. (I think it's not public yet) 
 
From: Mark J Cox <mjc@redhat.com> 
To: vendor-sec@lst.de 
Cc: mikx@mikx.de, pknirsch@redhat.com 
Subject: [vendor-sec] CAN-2005-0085 htdig XSS (embargoed) 
Errors-To: vendor-sec-admin@lst.de 
Date: Thu, 27 Jan 2005 10:29:24 +0000 (GMT) 
 
htdig suffers from a cross site scripting flaw as found by Michael Krax. 
Looks like this one is different to the last and isn't based on bad 
templates.  The flaw doesn't seem to affect the htdig on htdig.org 
although there is no patch in CVS, so maybe they applied a quick patch 
themselves. 
 
..../cgi-bin/htsearch?config=%3Ch1%3Eboo%3C/h1%3E 
 
Proposed patch from Phil Knirsch attached, this is CAN-2005-0085. 
 
Currently embargoed with no date set, probably suggest say Feb10 1400UTC 
unless Michael has a preference. 
 
Cheers, Mark 
 
--- htdig-3.2.0b6/htsearch/htsearch.cc.unescaped_output 2005-01-25 
12:50:51.000000000 +0100 
+++ htdig-3.2.0b6/htsearch/htsearch.cc  2005-01-25 12:52:45.000000000 +0100 
@@ -211,8 +211,7 @@ 
        } 
        if (access((char*)configFile, R_OK) < 0) 
        { 
-           reportError(form("Unable to read configuration file '%s'", 
-                            configFile.get())); 
+           reportError("Unable to read configuration file"); 
        } 
        config->Read(configFile); 
 
--- htdig-3.2.0b6/htsearch/qtest.cc.unescaped_output    2005-01-25 
12:51:00.000000000 +0100 
+++ htdig-3.2.0b6/htsearch/qtest.cc     2005-01-25 12:51:19.000000000 +0100 
@@ -132,8 +132,7 @@ 
 
     if (access((char*)configFile, R_OK) < 0) 
     { 
-       reportError(form("Unable to find configuration file '%s'", 
-                        configFile.get())); 
+       reportError("Unable to find configuration file"); 
     } 
 
     config->Read(configFile);