Ubuntu: 1249-1 Important: BackupPC XSS Vulnerability Summary

ubuntu

October 27, 2011

BackupPC could be made to expose sensitive information over the network.

Summary

BackupPC could be made to expose sensitive information over the network.

Software Description:

- backuppc: high-performance, enterprise-grade system for backing up PCs

Details:

It was discovered that BackupPC did not properly sanitize its input when

processing backup browser error messages, resulting in a cross-site

scripting (XSS) vulnerability. With cross-site scripting vulnerabilities,

if a user were tricked into viewing server output during a crafted server

request, a remote attacker could exploit this to modify the contents, or

steal confidential data, within the same domain. This issue did not affect

Ubuntu 11.10. (CVE-2011-3361)

Jamie Strandboge discovered that BackupPC did not properly sanitize its

input when processing log file viewer error messages, resulting in

cross-site scripting (XSS) vulnerabilities.

Topics Covered

security advisory critical XSS Ubuntu information exposure network threat BackupPC

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  backuppc                        3.2.1-1ubuntu1.1

Ubuntu 11.04:
  backuppc                        3.2.0-3ubuntu4.2

Ubuntu 10.10:
  backuppc                        3.1.0-9ubuntu2.2

Ubuntu 10.04 LTS:
  backuppc                        3.1.0-9ubuntu1.2

Ubuntu 8.04 LTS:
  backuppc                        3.0.0-4ubuntu1.3

In general, a standard system update will make all the necessary changes.