search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Standard HTML form implementation allows access to IMAP, SMTP, NNTP, POP3, and other services via crafted HTML page

Vulnerability Note VU#476267

Original Release Date: 2001-08-16 | Last Revised: 2008-02-05

Overview

An intruder can send certain kinds of data to services that he is not ordinarily able to reach. By crafting the data such that it is redirected through any program the victim uses to render the malicious HTML, the intruder is able send that data to any services that the victim can send data to. The malicious HTML can be embedded in documents such as an email message, web page, rich-text log or newsgroup posting.

Description

An intruder can send certain kinds of data to services that he is not ordinarily able to reach. By crafting the data such that it is redirected through any program the victim uses to render the malicious HTML, the intruder is able send that data to any services that the victim can send data to. If the victim is either tricked into clicking on a form submission button or a JavaScript program submits the form on behalf of the victim, the intruder's data may be sent to the service specified. Since the connection originates from the victim, any access control lists or restrictions designed to protect the server (such as a firewall) may not be effective. The data that the intruder is able to send is usually encoded as "multipart/form-data" by the browser, which necessarily inserts some header and encoding metadata, and is subject to any limitations of the protocol it attempts to attack.

This vulnerability has been called "cross-protocol scripting."

Impact

An intruder may be able to use this vulnerability to send mail (Spam), post News, get or send files from or to an FTP server, or send data to an HTTP server. It may even be possible to exploit a vulnerability in one of these services through this problem, though we are not certain of that at this time. For example, an intruder may be able to exploit this problem as a means of attacking a vulnerable web server that would ordinarily be protected by a firewall. Additionally, it may be possible for an intruder to cause denial-of-service conditions within the network by sending unexpected data to network services. This unexpected data may crash or hang the services receiving the data.

Solution

Upgrade your application according to your manufacturer's recommendations, if any. Additionally, do not rely solely on firewalls to provide a guarantee that an intruder can not reach a service. Keep internal systems up to date with respect to patches and workarounds.

Vendor Information

476267
Expand all

Microsoft Corporation

Notified:  August 03, 2001 Updated:  August 16, 2001

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Netscape Communications Corporation

Notified:  August 03, 2001 Updated:  August 16, 2001

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

The SCO Group (SCO Linux)

Notified:  August 03, 2001 Updated:  August 20, 2001

Status

  Vulnerable

Vendor Statement

Caldera's UNIX operating systems OpenServer Release 5, OpenUNIX Release 8 and UnixWare release 7 are NOT VULNERABLE to "The HTML Form Protocol Attack" on the specific ASCII-based protocols outlined in the Topf document.

The Following Caldera's Linux Operating Systems are Vulnerable (through the KDE 2 webbrowser 'konqueror'):
- - Caldera OpenLinux eDesktop 2.4
- - Caldera OpenLinux Workstation / Server 3.1

Not vulnerable:
- - Caldera OpenLinux 2.3
- - Caldera OpenLinux eServer 2.3.1

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

FreeBSD, Inc.

Notified:  August 03, 2001 Updated:  August 17, 2001

Status

  Not Vulnerable

Vendor Statement

FreeBSD does not ship a web browser in the base system. Several third-party browsers are available in the FreeBSD Ports Collection which may be vulnerable to this attack.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Apple Computer, Inc.

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Berkeley Software Design, Inc.

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cray Inc.

Notified:  August 03, 2001 Updated:  August 17, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

DeC

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Fujitsu

Notified:  August 03, 2001 Updated:  August 17, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

MiT Kerberos Development Team

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Mozilla

Updated:  February 04, 2008

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see http://www.mozilla.org/projects/netlib/PortBanning.html.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NEC Corporation

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NetBSD

Notified:  August 03, 2001 Updated:  August 17, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

OpenBSD

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Red Hat, Inc.

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

SGI

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sequent Computer Systems, Inc.

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Siemens Nixdorf

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sony Corporation

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sun Microsystems, Inc.

Notified:  August 03, 2001 Updated:  August 15, 2001

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

The CERT/CC thanks Jochen Topf <jochen@remote.org> for reporting this vulnerability. We would also like to thank Wietse Venema and Steve Bellovin for their assistance in understanding this vulnerability. Additionally Wietse Venema coined the name "cross-protocol scripting."

This document was written by Ian A. Finlay and Shawn V. Hernan.

Other Information

CVE IDs: None
Severity Metric: 15.00
Date Public: 2001-08-15
Date First Published: 2001-08-16
Date Last Updated: 2008-02-05 00:41 UTC
Document Revision: 49

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.