[Vulnerability Information]
 This vulnerability was found and reported by the original finder.

 -Reference Number:
  JVN#63041502

 -Title:
  Swat contains a cross-site scripting vulnerability

 -Affected Products:
  swat(samba web administration tool) of samba version 3.0.24
  *swat is included in samba package, therefore the samba version
   is described here.

 -Type of Vulnerability:
  Cross-site-scripting

 -Possible Impact:
  User information from a cookie could be stolen.
  An arbitrary web page could be injected.

 -Possible Workarounds:
  Sanitize meta characters when displaying the characters
  which the vulnerable application receives.

 -Brief Reproduction Information provided by the reporter:
  In the password resetting window after login,
    ---------------------------
    http://serverIP:901/passwd
    ---------------------------
  set
    ---------------------------
    ""><script>alert('xss');<script>
    ---------------------------
  in the username parameter and send the request.

 -Proof of Concept Code
  None

 -Validation:
  The result of validation will be available on March 9, 2007.

 -About Reporter:
  Reporter's information is distributable to the vendor and JPCERT/CC.
  The reporter requests an acknowledgment/credit in both vendor's and
  JVN advisories when publicly disclosed.

    About Reporter:
     Nobuhiro Tsuji, NTT DATA SECURITY CORPORATION
     Email:nobuhiro_tsuji@nttdata-sec.co.jp


[REPRODUCTION PROCEDURES]
IPA* has validated the reported vulnerability and verified its
reproduction successfully.

  *What's IPA?
   IPA = Information-technology Promotion Agency, Japan
   (http://www.ipa.go.jp/security/english/anti-virus-e.html)
   Our partner entity who receives the vulnerability reports
   from the original finders/reporters, and then validates them
   and verifies their reproductions, and passes those verified
   vulnerabilities to JPCERT/CC for vendor coordination.
   IPA does the deeper analysis and JPCERT/CC does coordination.
   Both IPA and JPCERT/CC are government designated entities to
   handle vulnerabilities information under the Early Warning
   Partnership in Information Security guideline.


 <ENVIRONMENT>

  Web Server:
  ------------------
  OS:
    Vine Linux 4.0
  Software:
    swat 3.0.24
  Server and related software:
    -Apache 2.2.3
    -inetd  3.10
    -samba  3.0.24
  IP Address:
    192.168.121.128
  Configuration:
    Set it by using following URL as a reference.
    http://www.samba.gr.jp/doc/contrib/begin_samba2.0.html
  Language:
    Japanese
  ------------------

  Client
  ------------------
  OS:
    Windows 2000 Professional SP4
  Web Browser:
    -Internet Explorer 6 SP1
    -Mozilla Firefox 2.0.0.2
    -Opera 9.10
  IP Address:
    192.168.121.129
  Language:
    Japanese
  ------------------

 <REPRODUCTION STEPS>

 1. Access to
      http://192.168.121.128:901/
    from the IE installed client, and then enter the
    password and ID to login.

 2. Click "PASSWORD" displayed on the right side of the window,
    then the window transfers.
    Enter the following script in "User Name" input field and
    then click "Change Password" button.
      -------------------------------------------------------
      ""><script>alert("xss");</script
      -------------------------------------------------------
    Then the script entered above is to be executed.

 3. To check the execution of the script and behavior on each browser,
    change the web browser from IE to Firefox, and to Opera, then repeat
    Reproduction Step 2. on each browser.
    Verify that the script is executed on each browser(IE, Firefox, and Opera).

    IPA verified the script execution and there was a cross-site
    scripting vulnerability in swat.

 <COMMENT FROM IPA>
  This only affects to the users who are able to log into swat.
  It may be possible that a remote attacker could possibly force
  a user to temporarily view a malicious forged web page,
  if it exploits