mailing list archives
From: <security () satus com>
Date: 17 Jun 2002 23:05:11 -0000
DeepMetrix (formerly MediaHouse) LiveStats is server
software that provides an interactive web based summary
of website traffic based on HTTP server logs.
By crafting special user-agent or referer headers on
HTTP requests to a web site that is monitored by
browser of a person viewing the LiveStats HTML reports.
LiveStats displays the browser-tag and referer strings
in its reports verbatim, including any script tags.
Script that discloses the URL of the LiveStats
interface could allow access that is normally protected
by a private ServerID.
Browse http://www.deepmetrix.com/ with a user-agent of
Then browse the Demo of LiveStats available on the
Deepmetrix web site at:
In the "Tabular - Who's On - XX Active Visitors" area
of the "Who's On" page, expand the IP address that
fetched. The next window will include the alert() popup.
Versions between 5.03 and 6.2.1 are affected. Vendor
was notified on 5/17/2002.
Satus Technology LLC
security () satus com