ID
VAR-E-201307-0312
CVE
| cve_id: | CVE-2013-3396 | Trust: 1.1 |
| cve_id: | CVE-2013-3395 | Trust: 0.8 |
TITLE
Cisco IronPort Security Management Appliance Multiple issues
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | cisco | model: | ironport | scope: | - | version: | - | Trust: 0.5 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.5.1 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.5 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.1.4 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.1.3 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.1.2 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.1.1 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.1 | Trust: 0.3 |
| vendor: | cisco | model: | web security appliance | scope: | eq | version: | 7.7 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.6.2 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.6.1 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.6 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.5.2 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.5.1 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.5 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.3.2 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.3.1 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.3 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.1.5 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.1.4 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.1.3 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.1.2 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.1.1 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.1 | Trust: 0.3 |
| vendor: | cisco | model: | email security appliance | scope: | eq | version: | 7.8 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 8.1 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 8.0 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.9.1 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.9 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.7.1 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.7 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.2.2 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.2.1 | Trust: 0.3 |
| vendor: | cisco | model: | content security management appliance | scope: | eq | version: | 7.2 | Trust: 0.3 |
EXPLOIT
- Advisory -
===============================
Tittle: Cisco IronPort Security Management Appliance - Multiple issues
Risk: Medium
Date: 20.May.2013
Author: Pedro Andujar
Twitter: @pandujar
.: [ INTRO ] :.
The Cisco Security Management Appliance helps to enable flexible management and comprehensive security control
at the network gateway. Is a central platform for managing all policy, reporting, and auditing information
for Cisco web and email security appliances.
.: [ TECHNICAL DESCRIPTION ] :.
Cisco IronPort Security Management Appliance M170 v7.9.1-030 (and probably other products), are prone to several security issues
as described below;
.: [ ISSUE #1 }:.
Name: Reflected Cross Site Scripting
Severity: Low
CVE: CVE-2013-3396
There is a lack of output escaping in the default error 500 page. When a exception occurs in the application, the error
description contains user unvalidated input from the request:
** PoC removed as requested by Cisco. **
.: [ ISSUE #2 }:.
Name: Stored Cross Site Scripting
Severity: Medium
Due to a lack of input validation on job_name, job_type, appliances_options and config_master parameters which are then
printed unscapped on job_name, old_job_name, job_type, appliance_lists and config_master fields.
** PoC removed as requested by Cisco. **
.: [ ISSUE #3 }:.
Name: CSRF Token is not used
Severity: Low
CVE: CVE-2013-3395
CSRFKey is not used in some areas of the application, which make even easier to exploit Reflected XSS Issues. In the /report area
of the application, we got no error even when completely removing the parameter CSRFKey;
** PoC removed as requested by Cisco. **
See: http://tools.cisco.com/security/center/viewAlert.x?alertId=29844
.: [ ISSUE #4 }:.
Name: Lack of password obfuscation
Severity: Low
When exporting the configuration file even if you mark the "mask password" option, the SNMPv3 password still appears in cleartext.
.: [ CHANGELOG ] :.
* 20/May/2013: - Vulnerability found.
* 27/May/2013: - Vendor contacted.
* 11/Jul/2013: - Public Disclosure
.: [ SOLUTIONS ] :.
Thanks to Stefano De Crescenzo (Cisco PSIRT Team), because of his professional way of managing the entire process.
Stored XSS
CSCuh24755
Reflected XSS
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3396
SNMP password issue
CSCuh27268, CSCuh70314
CSRF
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3395
.: [ REFERENCES ] :.
[+] Cisco Content Security Management Appliance M170
http://www.cisco.com/en/US/products/ps12503/index.html
[+] Cisco Security Advisories
http://tools.cisco.com/security/center/publicationListing.x
[+] !dSR - Digital Security Research
http://www.digitalsec.net/
-=EOF=-
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
xss, csrf
Trust: 0.5
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | vulnerability | Trust: 0.5 |
| tag: | xss | Trust: 0.5 |
| tag: | csrf | Trust: 0.5 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2013-3395 | Trust: 2.0 |
| db: | NVD | id: | CVE-2013-3396 | Trust: 1.7 |
| db: | EDBNET | id: | 83177 | Trust: 0.6 |
| db: | 0DAYTODAY | id: | 21168 | Trust: 0.6 |
| db: | EDBNET | id: | 21000 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 122955 | Trust: 0.5 |
| db: | BID | id: | 60919 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2013-3396 | Trust: 1.1 |
| url: | https://www.intelligentexploit.com | Trust: 0.6 |
| url: | https://0day.today/exploits/21168 | Trust: 0.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2013-3395 | Trust: 0.5 |
| url: | http://www.cisco.com/ | Trust: 0.3 |
| url: | http://tools.cisco.com/security/center/viewalert.x?alertid=29844 | Trust: 0.3 |
| url: | http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2013-3395 | Trust: 0.3 |
SOURCES
| db: | BID | id: | 60919 |
| db: | PACKETSTORM | id: | 122955 |
| db: | EDBNET | id: | 83177 |
| db: | EDBNET | id: | 21000 |
LAST UPDATE DATE
2022-07-27T09:38:00.335000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 60919 | date: | 2013-07-01T00:00:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 60919 | date: | 2013-07-01T00:00:00 |
| db: | PACKETSTORM | id: | 122955 | date: | 2013-08-26T20:58:21 |
| db: | EDBNET | id: | 83177 | date: | 2013-08-27T00:00:00 |
| db: | EDBNET | id: | 21000 | date: | 2013-08-27T00:00:00 |