JW Player Multiple Cross Site Scripting Vulnerabilities

http://www.securityfocus.com/bid/48214

Security Info

Bugtraq ID:	48214
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 10 2011 12:00AM
Updated:	Aug 03 2012 03:22PM
Credit:	Szymon Gruszecki
Vulnerable:	LongTail JW Player 5.6

Not Vulnerable:

Security Discussion

JW Player is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JW Player 5.6 is vulnerable; other versions may also be affected.

Proof of Concept and Security Exploits

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

Security Solution(s)

Solution:
The vendor has fixed the issue in the SVN repository. Please see the references for more information.

Security References(s)

References:

Product Homepage (JW Player)
Ticket #1347 (closed bug: fixed) (JW Player)

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services