[Japanese]

JVNDB-2006-000616

DonutP and UnDonut confirmation dialog display vulnerability

Overview

DonutP and its successor, unDonut, are IE-based tabbed web browsers. In DonutP and old versions of unDonut, Donut.P API does not require explicit user consent. Therefore DonutP and unDonut contain a vulnerability which may allow an attacker to execute a cross-site scripting and other attacks.

DonutP.API is disabled by default, so this vulnerability only affects users who have activated it.

In unDonut release10-beta-2 and later versions, the function displaying a dialog when a script is executed is enabled by default, and it requires an user's confirmation whether the script should be executed or not.

Users of DonutP or old versions of unDonut are recommended to upgrade to the latest version of unDonut. Users are also recommended to enable the confirmation dialog display function when a script is to be executed.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


unDonut
  • DonutP All versions
  • UnDonut earlier than 10-beta-2

Impact

An attacker could take over the user's web browser when the user views the malicious page.
Solution

Vendor Information

unDonut
CWE (What is CWE?)

CVE (What is CVE?)

References

  1. JVN : JVN#7F8621DE
Revision History

  • [2008/05/21]
      Web page published

Date Public2006/04/27
Date First Published2008/05/21
Date Last Updated2008/05/21