https://www.securityfocus.com/bid/88775
https://cxsecurity.com/issue/WLB-2005090001
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200509-150

Sawmill是透过分析LogFile的方式来提供网站的访客流量数据的软件，让你知道网友的停留时间、浏览网页等的喜好分析。Sawmill7.0.0-7.1.13中的跨站点脚本(XSS)漏洞，允许远程攻击者通过HTTPGET请求中的查询字符串来注入任意的Web脚本或HTML。

Bugtraq,

This has been delayed until the vendor had released a new version:

<<<<SNIP>>>>>
Date: Fri, 26 Aug 2005 11:48:48 -0700
From: Greg Ferrar <ferrar (at) flowerfire (dot) com [email concealed]>
User-Agent: Mozilla Thunderbird 1.0.2 (Macintosh/20050317)
X-Accept-Language: en-us, en
To: Terence.Wong (at) nta-monitor (dot) com [email concealed]
Cc: support (at) sawmill.co (dot) uk [email concealed]
Subject: Re: FW: XSS vulnerability
X-Scanned-By: MIMEDefang 2.48 on 192.168.124.1

Terence,

Thank you for reporting this vulerability in Sawmill. We have researched

this, and verified this vulnerability. This vulnerability exists in
Sawmill version 7.0.0 through 7.1.13. All platforms, including Windows,
are vulerable to this attack.

We have fixed this in the latest internal version, by replacing < and
< and > with >, and & with &, in the error message. You can
get a pre-release with the fix from http://sawmill.net/prerelease.html .

We plan to ship Sawmill 7.1.14 next week, probably next Friday. It is
possible it will be delayed by as much as a week. So as a tentative
timeline, can we aim for release in two weeks, or earlier if 7.1.14
becomes available before then?

Greg

<<<<<SNIP>>>

Sawmill XSS Vulnerability

[Overview]

The web administration page for the Sawmil log analysis software is 
vulnerable to an XSS attack. The attacker does not need to be 
authenticated to perform this attack

[Vulnerability Details]

Sawmill's built in webserver assumes that any query string appended to a 
GET request is a configuration command. This query string is not 
validated correctly for HTML tags so an attacker can use <script> tags 
to alter the output that is displayed to the browser.

Possible attacks are varied, and can include creating a false login page 
to capture authentication details.

Example simple attack:

http://host/?bla=%3Cscript%3Ealert('XSS');%3C/script%3E

[Affected Versions]

Version 7.1.13 (and below?) is affected by this vulnerability.

The previous version 6.5.11 is not affected by this issue. The latest 
version 7.1.14 is not affected by this issue.

At this time only the windows and the source code (on linux) download 
versions have been tested.

[Solution]

Upgrade to version 7.1.14 or newer.

[Timeline]

The vulnerability was first discovered on 22nd August 2005. Fix 
availible on 8th September 2005.

[References]

http://www.nta-monitor.com/news/xss/sawmill/index.htm

http://www.sawmill.net

Mark Terry

Research and Development
NTA Monitor Ltd
14 Ashford House,
Beaufort Court,
Medway City Estate,
Rochester,
Kent ME2 4FA, UK

Email: mark.terry (at) nta-monitor (dot) com [email concealed]
WWW:   http://www.nta-monitor.com

Tel:   01634 721855
Fax:   01634 721844

Sawmill Sawmill 7.1.14

Sawmill Sawmill 7.1.13

Sawmill Sawmill 7.1.9

Sawmill Sawmill 7.1.8

Sawmill Sawmill 7.1.7

Sawmill Sawmill 7.1.4

Sawmill Sawmill 7.0

来源:XF
名称:sawmill-unknown-xss(22206)
链接:http://xforce.iss.net/xforce/xfdb/22206
来源:www.sawmill.net
链接:http://www.sawmill.net/version_history.html
来源:MISC
链接:http://www.nta-monitor.com/news/xss/sawmill/index.htm
来源:SECUNIA
名称:16744
链接:http://secunia.com/advisories/16744/
来源:SREASON
名称:1
链接:http://securityreason.com/securityalert/1
来源:BUGTRAQ
名称:20050912SawmillXSSvuln
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112654659400488&w;=2