Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dojo | Dojotoolkit | 1.0 (including) | 1.0 (including) |
| Dojo | Dojotoolkit | 1.0.1 (including) | 1.0.1 (including) |
| Dojo | Dojotoolkit | 1.0.2 (including) | 1.0.2 (including) |
| Dojo | Dojotoolkit | 1.1 (including) | 1.1 (including) |
| Dojo | Dojotoolkit | 1.1.1 (including) | 1.1.1 (including) |
| Dojo | Dojotoolkit | 1.2 (including) | 1.2 (including) |
| Dojo | Dojotoolkit | 1.2.1 (including) | 1.2.1 (including) |
| Dojo | Dojotoolkit | 1.2.2 (including) | 1.2.2 (including) |
| Dojo | Dojotoolkit | 1.2.3 (including) | 1.2.3 (including) |
| Dojo | Dojotoolkit | 1.3 (including) | 1.3 (including) |
| Dojo | Dojotoolkit | 1.3.1 (including) | 1.3.1 (including) |
| Dojo | Dojotoolkit | 1.3.2 (including) | 1.3.2 (including) |
| Dojo | Dojotoolkit | 1.4 (including) | 1.4 (including) |
| Dojo | Dojotoolkit | 1.4.1 (including) | 1.4.1 (including) |
| Dojo | Ubuntu | upstream | * |
References
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- http://secunia.com/advisories/38964
- http://secunia.com/advisories/40007
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
- http://www.vupen.com/english/advisories/2010/1281
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- http://secunia.com/advisories/38964
- http://secunia.com/advisories/40007
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
- http://www.vupen.com/english/advisories/2010/1281