VARIoT IoT vulnerabilities database
| VAR-200909-0388 | CVE-2009-2871 | Cisco IOS Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN sessions, SSH sessions, or IKE encrypted nonces are enabled, allows remote attackers to cause a denial of service (device reload) via a crafted encrypted packet, aka Bug ID CSCsq24002. The problem is Bug ID : CSCsq24002 It is a problem.Interfering with service operations due to cleverly crafted encrypted packets (DoS) There is a possibility of being put into a state. Cisco IOS is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users.
This issue is being tracked by Cisco Bug ID CSCsq24002.http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq24002.
Cisco has released free software updates that address this
vulnerability.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-tls.shtml
Note: The September 23, 2009, Cisco IOS Security Advisory bundled
publication includes eleven Security Advisories. Each advisory lists the releases that correct the
vulnerability or vulnerabilities detailed in the advisory. The
following table lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on September 23, 2009, or
earlier.
http://www.cisco.com/warp/public/707/cisco-sa-20090923-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Advisory Bundled Publication" at the following
link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep09.html
Affected Products
=================
Vulnerable Products
+------------------
Devices running affected versions of Cisco IOS Software are
susceptible if configured with any of the following features:
* Secure Socket Layer (SSL) Virtual Private Network (VPN)
* Secure Shell (SSH)
* Internet Key Exchange (IKE) Encrypted Nonces
Note: Other SSL/HTTPS related features than WebVPN and SSL VPN are
not affected by this vulnerability.
To determine whether SSLVPN is enabled on a device, log in to the
device and issue the command-line interface (CLI) command "show
running-config | include webvpn". If the device returns any output
then SSLVPN is configured and the device may be vulnerable.
Vulnerable configurations vary depending on whether the device is
supporting Cisco IOS WebVPN (introduced in Release 12.3(14)T) or
Cisco IOS SSLVPNs (introduced in Release 12.4(6)T). The following
methods describe how to confirm if the device is vulnerable:
If the output from "show running-config | include webvpn" contains
"webvpn enable" then the device is configured with the original Cisco
IOS WebVPN. The only way to determine whether the device is
vulnerable is to examine the output of "show running-config" to
confirm that webvpn is enabled via the command "webvpn enable" and
that a "ssl trustpoint" has been configured. The following example
shows a vulnerable device configured with Cisco IOS WebVPN:
webvpn enable
!
webvpn
ssl trustpoint TP-self-signed-29742012
If the output from "show running-config | include webvpn" contains
"webvpn gateway <word>" then the device is supporting the Cisco IOS
SSLVPN feature. A device is vulnerable if it has the "inservice"
command in at least one of the "webvpn gateway" sections. The
following example shows a vulnerable device configured with Cisco IOS
SSLVPN:
Router# show running | section webvpn
webvpn gateway Gateway
ip address 10.1.1.1 port 443
ssl trustpoint Gateway-TP
inservice
!
Router#
A device that supports the Cisco IOS SSLVPN is not vulnerable if it
has no "webvpn gateways" configured or all the configured "webvpn
gateways" contain the "no inservice" webvpn gateway command.
To determine if SSH is enabled use the "show ip ssh" command, as shown
in the following example:
Router#show ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
To determine if the IKE encrypted nonces feature is enabled, use the
"show running-config | include rsa-encr" command as follows:
Router#show running-config | inc rsa-encr
authentication rsa-encr
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
!--- output truncated
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/warp/public/620/1.html
Products Confirmed Not Vulnerable
+--------------------------------
The Cisco ASA 5500 Series Adaptive Security Appliances are not
affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
A Cisco IOS device that is configured for SSLVPN or SSH may reload
when it receives a specially crafted TCP packet on TCP port 443
(SSLVPN) or TCP port 22 (SSH). Completion of the three-way handshake
to the associated TCP port number of these features is required for
the vulnerability to be successfully exploited; however,
authentication is not required.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsq24002 - Crafted Encrypted packet may cause device reload
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability described in this
document may result in a reload of the device. The issue could be
repeatedly exploited to cause an extended DoS condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | Recommended |
| 12.0-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.1-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.2-Based | First Fixed Release | Release |
| Releases | | |
|------------+----------------------------------------+-------------|
| 12.2 | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2B | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2BC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2BW | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2BX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2BY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2BZ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2CX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2CY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2CZ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2DA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2DD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2DX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2EW | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2EWA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2EX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2EY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2EZ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2FX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2FY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2FZ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IRA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IRB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IRC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXF | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2IXH | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2JA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2JK | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2MB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2MC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2S | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SBC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SCA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SCB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SEA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SEB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SEC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SED | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SEE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SEF | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SEG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SGA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SL | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SM | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SO | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SQ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SRA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SRB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SRC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SRD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2STE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SU | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SV | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SVA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SVC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SVD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SVE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SW | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXF | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXH | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SXI | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2SZ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2T | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2TPC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XF | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XH | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XI | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XJ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XK | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XL | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XM | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XNA | Please see Cisco IOS-XE Software | |
| | Availability | |
|------------+----------------------------------------+-------------|
| 12.2XNB | Please see Cisco IOS-XE Software | |
| | Availability | |
|------------+----------------------------------------+-------------|
| 12.2XNC | Please see Cisco IOS-XE Software | |
| | Availability | |
|------------+----------------------------------------+-------------|
| 12.2XND | Please see Cisco IOS-XE Software | |
| | Availability | |
|------------+----------------------------------------+-------------|
| 12.2XO | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XQ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XR | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XS | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XT | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XU | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XV | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2XW | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YF | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YH | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YJ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YK | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YL | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YM | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YN | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YO | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YP | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YQ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YR | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YS | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YT | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YU | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YV | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YW | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2YZ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZF | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZH | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZJ | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZL | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZP | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZU | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZY | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.2ZYA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| Affected | | Recommended |
| 12.3-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.3 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.4-Based | First Fixed Release | Release |
| Releases | | |
|------------+----------------------------------------+-------------|
| 12.4 | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4GC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JDA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JDC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JDD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JK | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JL | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JMA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JMB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4JX | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4MD | 12.4(15)MD3 | 12.4(15)MD3 |
|------------+----------------------------------------+-------------|
| 12.4MDA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4MR | 12.4(19)MR3 | 12.4(19)MR3 |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4SW | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| | 12.4(22)T2 | |
| | | 12.4(15)T10 |
| 12.4T | 12.4(20)T3 | |
| | | 12.4(20)T4 |
| | 12.4(24)T | |
|------------+----------------------------------------+-------------|
| 12.4XA | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XC | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XE | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4XF | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| 12.4XG | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4XJ | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4XK | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| 12.4XL | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XM | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XN | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XP | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4XQ | 12.4(15)XQ3 | 12.4(15)T10 |
|------------+----------------------------------------+-------------|
| | | 12.4(15)XR7 |
| 12.4XR | 12.4(15)XR5 | |
| | | 12.4(22)XR |
|------------+----------------------------------------+-------------|
| 12.4XT | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| | Vulnerable; Contact your support | |
| 12.4XV | organization per the instructions in | |
| | Obtaining Fixed Software section of | |
| | this advisory | |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4XW | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4XY | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4XZ | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| | | 12.4(15)T10 |
| 12.4YA | Vulnerable; first fixed in 12.4T | |
| | | 12.4(20)T4 |
|------------+----------------------------------------+-------------|
| 12.4YB | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4YD | Not Vulnerable | |
|------------+----------------------------------------+-------------|
| 12.4YE | Not Vulnerable | |
+-------------------------------------------------------------------+
Note: No Cisco IOS Software Modularity releases are affected by this
vulnerability.
Cisco IOS XE Software
+-------------------------------------------------------------------+
| IOS XE Release | First Fixed Release |
|----------------------------+--------------------------------------|
| 2.1.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.2.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.3.x | 2.3.2 |
|----------------------------+--------------------------------------|
| 2.4.x | Not Vulnerable |
+-------------------------------------------------------------------+
Workarounds
===========
There are no available workarounds other than disabling the affected
features and protecting SSH access with the use of VTY access control
lists.
Use the "no webvpn enable" command to disable SSL VPN use.
For Cisco IOS the SSH server can be disabled by applying the command
"crypto key zeroize rsa" while in configuration mode. The SSH server is
enabled automatically upon generating an RSA key pair. Zeroing the
RSA keys is the only way to completely disable the SSH server.
Access to the SSH server on Cisco IOS Software may also be disabled
by removing SSH as a valid transport protocol. This action can be
done by reapplying the transport input command with 'ssh' removed
from the list of permitted transports on vty lines while in
configuration mode. For example:
line vty 0 4
transport input telnet
end
If SSH server functionality is desired, access to the server can be
restricted to specific source IP addresses or blocked entirely
through the use of Access Control Lists (ACLs) on the vty lines as
shown in the following URL:
http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/configuration/guide/swacl.html#xtocid14
More information on configuring ACLs can be found on Cisco's public
website:
http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml
The following is an example of a vty access-list:
access-list 2 permit 10.1.1.0 0.0.0.255
access-list 2 deny any
line vty 0 4
access-class 2 in
In the previous example, only the 10.1.1.0/24 network is allowed to
SSH to the Cisco IOS device.
To disable IKE encrypted nonces use the "no authentication rsa-encr"
command under an ISAKMP policy, as shown in the following example:
crypto isakmp policy
no authentication rsa-encr
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was found during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-tls.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+----------------------------------------+
| Revision | | Initial |
| 1.0 | 2009-September-23 | public |
| | | release |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFKukGd86n/Gc8U/uARAltxAJsHsWKROOB5Ph8mcFs+ZUIYygRoEgCePeZX
A9ezksakGzQynAYZbBjJ+uE=
=n8Uh
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
1) An error exists in the login section of the Extension Mobility
feature of the Cisco Unified CME (Communications Manager Express)
component. This can be exploited to cause a buffer overflow via
specially crafted HTTP requests.
Successful exploitation may allow execution of arbitrary code.
2) An error in the IKE implementation can be exploited to allocate
all available Phase 1 SAs and prevent new IPSec sessions from being
established.
Successful exploitation requires that the IKE certificate based
authentication method is used.
3) Multiple errors exist in the IP tunnelling implementation when
switching network packets. These can be exploited to trigger a device
reload via specially crafted packets.
Successful exploitation requires that the device is configured for
PPTP, GRE, IPinIP, Generic Packet Tunneling in IPv6, or IPv6 over IP
tunnels, and Cisco Express Forwarding.
4) An error in the implementation of the Object Groups for ACLs
feature can be exploited to bypass access control policies.
Successful exploitation requires that H.323 is enabled (disabled by
default).
6) An error in the SIP implementation related to the Cisco Unified
Border Element feature can be exploited to trigger a device reload.
8) A race condition error exists in the Authentication Proxy for
HTTP(S), Web Authentication, and consent features. This can be
exploited to bypass the authentication proxy services and the consent
accept web page if a successfully authenticated session or accepted
consent session exists.
9) An error exists in the Cisco IOS Zone-Based Policy Firewall SIP
inspection feature. This can be exploited to reload a device via a
specially crafted SIP transit packet.
10) An error exists in the NTPv4 implementation while creating NTP
reply packets. This can be exploited to trigger a device reload via a
specially crafted NTP packet.
SOLUTION:
Update to a fixed version (please see the vendor's advisories for
details).
PROVIDED AND/OR DISCOVERED BY:
1, 3-10) Reported by the vendor.
2) Reported to the vendor by a customer.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-cme.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-ipsec.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-tunnels.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-acl.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-h323.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-sip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-tls.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-auth-proxy.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-ios-fw.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-ntp.shtml
OTHER REFERENCES:
SA36836:
http://secunia.com/advisories/36836/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200909-0379 | CVE-2009-2862 | Cisco IOS of ACL Vulnerabilities that prevent access restrictions on functions |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252. The problem is Bug ID : CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122 and CSCsu50252 It is a problem.A well-crafted request can circumvent access restrictions. Cisco IOS is prone to a security-bypass vulnerability.
This issue is documented by the following Cisco Bug IDs:
CSCsx07114
CSCsu70214
CSCsw47076
CSCsv48603
CSCsy54122
CSCsu50252.
Cisco has released free software updates that address this
vulnerability. There are no workarounds for this vulnerability other
than disabling the Object Groups for ACLs feature.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-acl.shtml
Note: The September 23, 2009, Cisco IOS Security Advisory bundled
publication includes eleven Security Advisories. Ten of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the releases that correct the
vulnerability or vulnerabilities detailed in the advisory. The
following table lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on September 23, 2009, or
earlier.
http://www.cisco.com/warp/public/707/cisco-sa-20090923-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Advisory Bundled Publication" at the following
link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep09.html
Affected Products
=================
Vulnerable Products
+------------------
Any Cisco device configured with ACLs using the object group feature
and running an affected Cisco IOS software version is affected by
this vulnerability.
Note: The Object Groups for ACLs feature was introduced in Cisco IOS
software version 12.4(20)T.
To verify whether object groups are configured in a Cisco IOS device,
use the "show object-group" command in user EXEC or privileged EXEC
mode. The following example displays a sample output from the "show
object-group" command when object groups are configured:
Router# show object-group
Network object group my_host_group
host 172.18.104.123
Service object group my_allowed_services
tcp eq www
tcp eq 443
Alternatively, administrators can also use the "show running config |
include ^ (permit|deny) .*object-group" command to verify whether
object groups are configured, as shown in the following example:
Router#show running-config | include ^ (permit|deny) .*object-group
permit object-group my_allowed_services host 10.10.1.1 host 10.20.1.1
permit tcp any object-group my_host_group eq 22
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
!--- output truncated
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
!--- output truncated
Products Confirmed Not Vulnerable
+--------------------------------
Cisco devices that are not configured with object groups are not
vulnerable.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
In Cisco IOS Software an object group can contain a single object
(such as a single IP address, network, or subnet) or multiple objects
(such as a combination of multiple IP addresses, networks, or
subnets). In an ACL that is based on an object group, administrators
can create a single access control entry (ACE) that uses an object
group name instead of creating many ACEs, which each would require a
different IP address. A similar object group, such as a protocol port
group, can be extended to limit access to a set of applications for a
user group to a server group.
Note: The Object Groups for ACLs feature was introduced in Cisco IOS
software version 12.4(20)T.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, CSCsu50252 -
Object-group Access Control List Bypass
CVSS Base Score - 4.3
Access Vector - Network
Access Complexity - Medium
Authentication - None
Confidentiality Impact - Parital
Integrity Impact - None
Availability Impact - none
CVSS Temporal Score - 3.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability may allow an attacker to
access resources that should be protected by the Cisco IOS device.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | Recommended |
| 12.0-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.1-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.2-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.3-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.3 based releases. |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.4-Based | First Fixed Release | Release |
| Releases | | |
|------------+---------------------------------------+--------------|
| 12.4 | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| | Vulnerable; Contact your support | |
| 12.4GC | organization per the instructions in | |
| | Obtaining Fixed Software section of | |
| | this advisory | |
|------------+---------------------------------------+--------------|
| 12.4JA | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JDA | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JDC | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JDD | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JK | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JL | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JMA | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JMB | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4JX | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| | | 12.4(11)MD9 |
| | | |
| 12.4MD | 12.4(22)MD1 | 12.4(15)MD3 |
| | | |
| | | 12.4(22)MD1 |
|------------+---------------------------------------+--------------|
| 12.4MDA | 12.4(22)MDA1 | 12.4(22)MDA1 |
|------------+---------------------------------------+--------------|
| 12.4MR | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4SW | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| | | 12.4(20)T4 |
| | 12.4(22)T2 | |
| | | 12.4(22)T3 |
| 12.4T | 12.4(20)T4 | |
| | | 12.4(24)T2; |
| | 12.4(24)T1 | Available on |
| | | 23-OCT-2009 |
|------------+---------------------------------------+--------------|
| 12.4XA | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XB | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XC | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XD | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XE | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XF | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XG | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XJ | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XK | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XL | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XM | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XN | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XP | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XQ | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XR | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XT | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XV | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XW | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| 12.4XY | Not Vulnerable | |
|------------+---------------------------------------+--------------|
| | | 12.4(20)T4 |
| | | |
| | | 12.4(22)T3 |
| 12.4XZ | Vulnerable; first fixed in 12.4T | |
| | | 12.4(24)T2; |
| | | Available on |
| | | 23-OCT-2009 |
|------------+---------------------------------------+--------------|
| | | 12.4(22)T3 |
| | | |
| 12.4YA | Vulnerable; first fixed in 12.4T | 12.4(24)T2; |
| | | Available on |
| | | 23-OCT-2009 |
|------------+---------------------------------------+--------------|
| 12.4YB | 12.4(22)YB4 | 12.4(22)YB4 |
|------------+---------------------------------------+--------------|
| 12.4YD | 12.4(22)YD1 | 12.4(22)YD1 |
|------------+---------------------------------------+--------------|
| 12.4YE | 12.4(22)YE1 | 12.4(22)YE1 |
|------------+---------------------------------------+--------------|
| 12.4YG | Not Vulnerable | |
+-------------------------------------------------------------------+
Note: No Cisco IOS-XE or Cisco IOS Software Modularity releases are
affected by this vulnerability.
Workarounds
===========
There are no workarounds for this vulnerability other than disabling
the Object Groups for ACLs feature.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was found during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-acl.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+----------------------------------------+
| Revision | | Initial |
| 1.0 | 2009-September-23 | public |
| | | release |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFKukF586n/Gc8U/uARAuXEAJ99dU6Wi1fZMY1yNgedSCx4/+0p8wCeOSKF
HmMwzq017QkqDzBFo/JH6DQ=
=XJAG
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Cisco IOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA36835
VERIFY ADVISORY:
http://secunia.com/advisories/36835/
DESCRIPTION:
Some vulnerabilities have been reported in Cisco IOS, which can be
exploited by malicious people to cause a DoS (Denial of Service),
bypass certain security restrictions, disclose sensitive information,
or compromise a vulnerable device.
1) An error exists in the login section of the Extension Mobility
feature of the Cisco Unified CME (Communications Manager Express)
component. This can be exploited to cause a buffer overflow via
specially crafted HTTP requests.
Successful exploitation may allow execution of arbitrary code.
2) An error in the IKE implementation can be exploited to allocate
all available Phase 1 SAs and prevent new IPSec sessions from being
established.
Successful exploitation requires that the IKE certificate based
authentication method is used.
3) Multiple errors exist in the IP tunnelling implementation when
switching network packets. These can be exploited to trigger a device
reload via specially crafted packets.
Successful exploitation requires that the device is configured for
PPTP, GRE, IPinIP, Generic Packet Tunneling in IPv6, or IPv6 over IP
tunnels, and Cisco Express Forwarding.
5) An error in the H.323 implementation can be exploited to trigger a
device reload via specially crafted TCP packets.
Successful exploitation requires that H.323 is enabled (disabled by
default).
6) An error in the SIP implementation related to the Cisco Unified
Border Element feature can be exploited to trigger a device reload.
For more information:
SA36836
7) An error in the SSLVPN, SSH, and IKE Encrypted Nonces features can
be exploited to reload a device via specially crafted packets sent to
TCP ports 22 (for SSH) or 443 (for SSLVPN), or UDP ports 500 and 4500
(for IKE Encrypted Nonces).
8) A race condition error exists in the Authentication Proxy for
HTTP(S), Web Authentication, and consent features. This can be
exploited to bypass the authentication proxy services and the consent
accept web page if a successfully authenticated session or accepted
consent session exists.
9) An error exists in the Cisco IOS Zone-Based Policy Firewall SIP
inspection feature. This can be exploited to reload a device via a
specially crafted SIP transit packet.
10) An error exists in the NTPv4 implementation while creating NTP
reply packets. This can be exploited to trigger a device reload via a
specially crafted NTP packet.
SOLUTION:
Update to a fixed version (please see the vendor's advisories for
details).
PROVIDED AND/OR DISCOVERED BY:
1, 3-10) Reported by the vendor.
2) Reported to the vendor by a customer.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-cme.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-ipsec.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-tunnels.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-acl.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-h323.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-sip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-tls.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-auth-proxy.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-ios-fw.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090923-ntp.shtml
OTHER REFERENCES:
SA36836:
http://secunia.com/advisories/36836/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200911-0311 | CVE-2009-3898 | nginx of src/http/modules/ngx_http_dav_module.c Vulnerable to directory traversal |
CVSS V2: 4.9 CVSS V3: - Severity: MEDIUM |
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method. nginx of src/http/modules/ngx_http_dav_module.c Contains a directory traversal vulnerability.By a remotely authenticated user WebDAV (1) COPY Or (2) MOVE To the method .. The 'nginx' program is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues using directory-traversal strings ('../') to overwrite arbitrary files outside the root directory.
These issues affect nginx 0.7.61 and 0.7.62; other versions may also be affected. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
nginx WebDAV Directory Traversal Security Issue
SECUNIA ADVISORY ID:
SA36818
VERIFY ADVISORY:
http://secunia.com/advisories/36818/
DESCRIPTION:
A security issue has been discovered in nginx, which can be exploited
by malicious people to bypass certain security restrictions.
Successful exploitation requires that the server has been compiled
with the http_dav_module and that the attacker is allowed to use the
"MOVE" or "COPY" methods.
The security issue is reported in version 0.7.61 and confirmed in
version 0.7.62.
SOLUTION:
Restrict access to trusted users only.
PROVIDED AND/OR DISCOVERED BY:
Kingcope
ORIGINAL ADVISORY:
http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0379.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: nginx: Multiple vulnerabilities
Date: March 28, 2012
Bugs: #293785, #293786, #293788, #389319, #408367
ID: 201203-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in nginx, the worst of which
may allow execution of arbitrary code.
Background
==========
nginx is a robust, small, and high performance HTTP and reverse proxy
server.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-servers/nginx < 1.0.14 >= 1.0.14
Description
===========
Multiple vulnerabilities have been found in nginx:
* The TLS protocol does not properly handle session renegotiation
requests (CVE-2009-3555).
* The "ngx_http_process_request_headers()" function in ngx_http_parse.c
could cause a NULL pointer dereference (CVE-2009-3896).
* The "ngx_resolver_copy()" function in ngx_resolver.c contains a
boundary error which could cause a heap-based buffer overflow
(CVE-2011-4315).
* nginx does not properly parse HTTP header responses which could
expose sensitive information (CVE-2012-1180).
Impact
======
A remote attacker could possibly execute arbitrary code with the
privileges of the nginx process, cause a Denial of Service condition,
create or overwrite arbitrary files, or obtain sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All nginx users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/nginx-1.0.14"
References
==========
[ 1 ] CVE-2009-3555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3555
[ 2 ] CVE-2009-3896
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3896
[ 3 ] CVE-2009-3898
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3898
[ 4 ] CVE-2011-4315
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4315
[ 5 ] CVE-2012-1180
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1180
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-22.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Gentoo update for nginx
SECUNIA ADVISORY ID:
SA48577
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48577/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48577
RELEASE DATE:
2012-03-28
DISCUSS ADVISORY:
http://secunia.com/advisories/48577/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48577/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48577
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Gentoo has issued an update for nginx.
For more information:
SA36751
SA36818
SA37291
SA46798
SA48366
SOLUTION:
Update to "www-servers/nginx-1.0.14" or later
| VAR-200909-0332 | CVE-2009-2817 | Apple iTunes '.pls' File Buffer Overflow Vulnerability |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .pls file. Apple iTunes is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Versions prior to Apple iTunes 9.0.1 are vulnerable
| VAR-200909-0226 | CVE-2009-3485 | Juniper JUNOS of J-Web Interface cross-site scripting vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
This issue affects the following:
J-Web 8.5R1.14
J-Web 9.0R1.1. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Juniper JUNOS JWeb Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA36829
VERIFY ADVISORY:
http://secunia.com/advisories/36829/
DESCRIPTION:
Some vulnerabilities have been reported in Juniper JUNOS, which can
be exploited by malicious people to conduct cross-site scripting
attacks and by malicious users to conduct script insertion attacks.
1) Input passed via the URL to the JWeb administrative web interface
is not properly sanitised before being returned to the user.
2) Input passed via multiple parameters to the JWeb administrative
web interface is not properly sanitised before being returned to the
user.
The following parameters passed to the following scripts are
reportedly affected:
* "host" to /diagnose?m[]=pinghost and /diagnose?m[]=traceroute
* "probe-limit" to /configuration?m[]=wizards&m[]=rpm
* "wizard_ids" and "pager-new-identifier" to
/configuration?m[]=wizards&m[]=firewall-acl&m[]=firewall-filters
* "os-physical-interface-name" to
/configuration?m[]=wizards&m[]=cos&m[]=cos-interfaces
* "wizard-args" and "wizard-ids" to
/configuration?m[]=wizards&m[]=snmp
* "username" and "fullname" to /configuration?m[]=wizards&m[]=users
* "certname" and "certbody" to /configuration?m[]=wizards&m[]=https
3) Input passed via multiple parameters to the JWeb administrative
web interface is not properly sanitised before being returned to the
user.
The following parameters passed to the following scripts are
reportedly affected:
* "JEXEC_OUTID" to
/jexec?JEXEC_MODE=JEXEC_MODE_RELAY_OUTPUT&JEXEC_RPC=request-background-task-start-junoscript
* "act" to /scripter.php?debug=1&ifid=1&refresh-time=1
* "refresh-time" to /scripter.php
* "ifid" to /scripter?act=header
* "revision" to /configuration?m[]=history&action=rollback
* "m[]" to /monitor, /manage, /events, /configuration, /alarms, and
/
" "wizard-next" to /configuration?m[]=wizards&m[]=https
4) Input passed via the "Contact Information", "System Description",
"Local Engine ID", "System Location", and "System Name Override"
fields to /configuration?m[]=wizards&m[]=snmp&start=true is not
properly sanitised before being stored.
Vulnerability #1 is reported in JWeb version 8.5R1.14 and 9.0R1.1.
Vulnerabilities #2 through #4 are reported in version 8.5R1.14.
SOLUTION:
Filter malicious characters and character sequences in a web proxy.
PROVIDED AND/OR DISCOVERED BY:
1, 2) Amir Azam of ProCheckUp Ltd
3, 4) Richard Brain of ProCheckUp Ltd
ORIGINAL ADVISORY:
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-08
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-09
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-10
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200909-0228 | CVE-2009-3487 | Juniper JUNOS of J-Web Interface cross-site scripting vulnerability |
CVSS V2: 3.5 CVSS V3: - Severity: LOW |
Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via (1) the JEXEC_OUTID parameter in a JEXEC_MODE_RELAY_OUTPUT action to the jexec program; the (2) act, (3) refresh-time, or (4) ifid parameter to scripter.php; (5) the revision parameter in a rollback action to the configuration program; the m[] parameter to the (6) monitor, (7) manage, (8) events, (9) configuration, or (10) alarms program; (11) the m[] parameter to the default URI; (12) the m[] parameter in a browse action to the default URI; (13) the wizard-next parameter in an https action to the configuration program; or the (14) Contact Information, (15) System Description, (16) Local Engine ID, (17) System Location, or (18) System Name Override SNMP parameter, related to the configuration program. Juniper JUNOS of J-Web There is a cross-site scripting vulnerability in the interface due to flaws in the processing related to the configuration program.By a remotely authenticated user, any Web Script or HTML May be inserted. Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web (Juniper Web Management).
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
This issue affects the following:
J-Web 8.5R1.14
J-Web 9.0R1.1. JUNOS is prone to a cross-site scripting vulnerability. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Juniper JUNOS JWeb Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA36829
VERIFY ADVISORY:
http://secunia.com/advisories/36829/
DESCRIPTION:
Some vulnerabilities have been reported in Juniper JUNOS, which can
be exploited by malicious people to conduct cross-site scripting
attacks and by malicious users to conduct script insertion attacks.
1) Input passed via the URL to the JWeb administrative web interface
is not properly sanitised before being returned to the user.
2) Input passed via multiple parameters to the JWeb administrative
web interface is not properly sanitised before being returned to the
user.
The following parameters passed to the following scripts are
reportedly affected:
* "host" to /diagnose?m[]=pinghost and /diagnose?m[]=traceroute
* "probe-limit" to /configuration?m[]=wizards&m[]=rpm
* "wizard_ids" and "pager-new-identifier" to
/configuration?m[]=wizards&m[]=firewall-acl&m[]=firewall-filters
* "os-physical-interface-name" to
/configuration?m[]=wizards&m[]=cos&m[]=cos-interfaces
* "wizard-args" and "wizard-ids" to
/configuration?m[]=wizards&m[]=snmp
* "username" and "fullname" to /configuration?m[]=wizards&m[]=users
* "certname" and "certbody" to /configuration?m[]=wizards&m[]=https
3) Input passed via multiple parameters to the JWeb administrative
web interface is not properly sanitised before being returned to the
user.
Vulnerability #1 is reported in JWeb version 8.5R1.14 and 9.0R1.1.
Vulnerabilities #2 through #4 are reported in version 8.5R1.14.
SOLUTION:
Filter malicious characters and character sequences in a web proxy.
PROVIDED AND/OR DISCOVERED BY:
1, 2) Amir Azam of ProCheckUp Ltd
3, 4) Richard Brain of ProCheckUp Ltd
ORIGINAL ADVISORY:
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-08
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-09
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-10
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200909-0227 | CVE-2009-3486 | Juniper JUNOS of J-Web Interface cross-site scripting vulnerability |
CVSS V2: 3.5 CVSS V3: - Severity: LOW |
Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to (1) the pinghost program, reachable through the diagnose program; or (2) the traceroute program, reachable through the diagnose program; or (3) the probe-limit parameter to the configuration program; the (4) wizard-ids or (5) pager-new-identifier parameter in a firewall-filters action to the configuration program; (6) the cos-physical-interface-name parameter in a cos-physical-interfaces-edit action to the configuration program; the (7) wizard-args or (8) wizard-ids parameter in an snmp action to the configuration program; the (9) username or (10) fullname parameter in a users action to the configuration program; or the (11) certname or (12) certbody parameter in a local-cert (aka https) action to the configuration program. Juniper JUNOS of J-Web The interface contains a cross-site scripting vulnerability.Depending on the remote authenticated user, host Any via parameter Web Script or HTML May be inserted. Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web (Juniper Web Management).
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
This issue affects the following:
J-Web 8.5R1.14
J-Web 9.0R1.1. JUNOS is prone to a cross-site scripting vulnerability. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Juniper JUNOS JWeb Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA36829
VERIFY ADVISORY:
http://secunia.com/advisories/36829/
DESCRIPTION:
Some vulnerabilities have been reported in Juniper JUNOS, which can
be exploited by malicious people to conduct cross-site scripting
attacks and by malicious users to conduct script insertion attacks.
1) Input passed via the URL to the JWeb administrative web interface
is not properly sanitised before being returned to the user.
2) Input passed via multiple parameters to the JWeb administrative
web interface is not properly sanitised before being returned to the
user.
The following parameters passed to the following scripts are
reportedly affected:
* "host" to /diagnose?m[]=pinghost and /diagnose?m[]=traceroute
* "probe-limit" to /configuration?m[]=wizards&m[]=rpm
* "wizard_ids" and "pager-new-identifier" to
/configuration?m[]=wizards&m[]=firewall-acl&m[]=firewall-filters
* "os-physical-interface-name" to
/configuration?m[]=wizards&m[]=cos&m[]=cos-interfaces
* "wizard-args" and "wizard-ids" to
/configuration?m[]=wizards&m[]=snmp
* "username" and "fullname" to /configuration?m[]=wizards&m[]=users
* "certname" and "certbody" to /configuration?m[]=wizards&m[]=https
3) Input passed via multiple parameters to the JWeb administrative
web interface is not properly sanitised before being returned to the
user.
The following parameters passed to the following scripts are
reportedly affected:
* "JEXEC_OUTID" to
/jexec?JEXEC_MODE=JEXEC_MODE_RELAY_OUTPUT&JEXEC_RPC=request-background-task-start-junoscript
* "act" to /scripter.php?debug=1&ifid=1&refresh-time=1
* "refresh-time" to /scripter.php
* "ifid" to /scripter?act=header
* "revision" to /configuration?m[]=history&action=rollback
* "m[]" to /monitor, /manage, /events, /configuration, /alarms, and
/
" "wizard-next" to /configuration?m[]=wizards&m[]=https
4) Input passed via the "Contact Information", "System Description",
"Local Engine ID", "System Location", and "System Name Override"
fields to /configuration?m[]=wizards&m[]=snmp&start=true is not
properly sanitised before being stored.
Vulnerability #1 is reported in JWeb version 8.5R1.14 and 9.0R1.1.
Vulnerabilities #2 through #4 are reported in version 8.5R1.14.
SOLUTION:
Filter malicious characters and character sequences in a web proxy.
PROVIDED AND/OR DISCOVERED BY:
1, 2) Amir Azam of ProCheckUp Ltd
3, 4) Richard Brain of ProCheckUp Ltd
ORIGINAL ADVISORY:
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-08
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-09
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-10
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201003-0011 | CVE-2009-4664 | Firewall Builder Vulnerability gained in |
CVSS V2: 3.3 CVSS V3: - Severity: LOW |
Firewall Builder 3.0.4, 3.0.5, and 3.0.6, when running on Linux, allows local users to gain privileges via a symlink attack on an unspecified temporary file that is created by the iptables script. Firewall Builder creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files or to execute arbitrary code with elevated privileges.
Firewall Builder 3.0.4, 3.0.5, and 3.0.6 are vulnerable; other versions may also be affected. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Firewall Builder Insecure Temporary Files
SECUNIA ADVISORY ID:
SA36809
VERIFY ADVISORY:
http://secunia.com/advisories/36809/
DESCRIPTION:
A security issue has been reported in Firewall Builder, which can be
exploited by malicious, local users to perform certain actions with
escalated privileges. This
can be exploited to e.g. overwrite arbitrary files via symlink
attacks.
Note: Only scripts setting iptable's static routing configuration are
affected.
The security issue is reported in versions 3.0.4, 3.0.5, and 3.0.6.
SOLUTION:
Update to version 3.0.7.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://blog.fwbuilder.org/2009/09/firewall-builder-v307-released.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
Background
==========
Firewall Builder is a GUI for easy management of multiple firewall
platforms.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Firewall Builder users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-firewall/fwbuilder-3.0.7"
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since March 09, 2010. It is likely that your system is
already no longer affected by this issue.
References
==========
[ 1 ] CVE-2008-4956
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4956
[ 2 ] CVE-2009-4664
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4664
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201201-11.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS
http://secunia.com/blog/71/
----------------------------------------------------------------------
TITLE:
Fedora update for fwbuilder and libfwbuilder
SECUNIA ADVISORY ID:
SA38585
VERIFY ADVISORY:
http://secunia.com/advisories/38585/
DESCRIPTION:
Fedora has issued an update for fwbuilder and libfwbuilder.
For more information:
SA36809
SOLUTION:
Apply updated packages using the yum utility ("yum update fwbuilder
libfwbuilder")
| VAR-200909-0207 | CVE-2009-3272 | Apple Safari of WebKit.dll Service disruption in (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Stack consumption vulnerability in WebKit.dll in WebKit in Apple Safari 3.2.3, and possibly other versions before 4.1.2, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls eval on a long string composed of A/ sequences. Apple Safari of WebKit of WebKit.dll In this case, a stack consumption state occurs, which disrupts service operation. Safari is prone to a denial-of-service vulnerability. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial:
http://secunia.com/products/corporate/vim/
----------------------------------------------------------------------
TITLE:
SUSE update for Multiple Packages
SECUNIA ADVISORY ID:
SA43068
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43068/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43068
RELEASE DATE:
2011-01-25
DISCUSS ADVISORY:
http://secunia.com/advisories/43068/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43068/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43068
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
SUSE has issued an update for multiple packages, which fixes multiple
vulnerabilities.
For more information:
SA32349
SA33495
SA35095
SA35379
SA35411
SA35449
SA35758
SA36269
SA36677
SA37273
SA37346
SA37769
SA38061
SA38545
SA38932
SA39029
SA39091
SA39384
SA39661
SA39937
SA40002
SA40072
SA40105
SA40112
SA40148
SA40196
SA40257
SA40664
SA40783
SA41014
SA41085
SA41242
SA41328
SA41390
SA41443
SA41535
SA41841
SA41888
SA41968
SA42151
SA42264
SA42290
SA42312
SA42443
SA42461
SA42658
SA42769
SA42886
SA42956
SA43053
SOLUTION:
Apply updated packages via YaST Online Update or the SUSE FTP server.
ORIGINAL ADVISORY:
SUSE-SR:2011:002:
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200909-0478 | CVE-2009-3248 |
vtiger CRM of RSS Module vulnerable to cross-site request forgery
Related entries in the VARIoT exploits database: VAR-E-200908-0598 |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php
| VAR-200909-0480 | CVE-2009-3250 |
vtiger CRM of Compose Mail Vulnerability to execute arbitrary code in function
Related entries in the VARIoT exploits database: VAR-E-200908-0598 |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/. (1) specific Apache HTTP Server Setting environment .php (2) Windows upper .php (3) Linux upper .php/. vtiger CRM is prone to a remote security vulnerability.
An attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause a denial-of-service condition
| VAR-200909-0213 | CVE-2009-3257 | vtiger CRM Vulnerabilities in which permissions are bypassed |
CVSS V2: 3.6 CVSS V3: - Severity: LOW |
vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile. vtiger CRM is prone to a remote security vulnerability
| VAR-200909-0577 | No CVE | Avaya Intuity Audix LX Multiple Input Validation Vulnerabilities |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Intuity Audix LX is a powerful multimedia messaging server. Multiple CGI perl scripts in the /html/cswebadm/basic/cgibin/ directory of Intuity Audix LX do not properly validate user-submitted parameter requests, and remote attackers can execute arbitrary code by submitting HTTP POST requests; The url parameter of /cgi-bin/smallmenu.pl may cause cross-site scripting attacks; the use of tokenization protection management changes when logging into the web interface may result in cross-site request forgery attacks. Avaya Intuity Audix LX is prone to multiple remote vulnerabilities, including:
1. Multiple remote command-execution vulnerabilities
2. A cross-site request-forgery vulnerability
3. A cross-site scripting vulnerability
Attackers can exploit these issues to execute arbitrary commands with the privileges of 'vexvm' on the underlying system, steal cookie-based authentication credentials, execute arbitrary script code, and perform administrative tasks. Other attacks are also possible
| VAR-200909-0481 | CVE-2009-3251 | vtiger CRM of include/utils/ListViewUtils.php Vulnerabilities that bypass restrictions |
CVSS V2: 4.0 CVSS V3: - Severity: MEDIUM |
include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows remote authenticated users to bypass intended access restrictions and read the (1) visibility, (2) location, and (3) recurrence fields of a calendar via a custom view. vtiger CRM is prone to a security bypass vulnerability
| VAR-200909-0214 | CVE-2009-3258 | vtiger CRM Vulnerable to deleting attachments |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete (1) attachments, (2) reports, (3) filters, (4) views, and (5) tickets; insert (6) attachments, (7) reports, (8) filters, (9) views, and (10) tickets; and edit (11) reports, (12) filters, (13) views, and (14) tickets via unspecified vectors. vtiger CRM is prone to a remote security vulnerability
| VAR-200909-0479 | CVE-2009-3249 |
vtiger CRM Vulnerable to directory traversal
Related entries in the VARIoT exploits database: VAR-E-201103-0495, VAR-E-200908-0598 |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php, reachable through modules/Campaigns/CampaignsAjax.php, modules/SalesOrder/SalesOrderAjax.php, modules/System/SystemAjax.php, modules/Products/ProductsAjax.php, modules/uploads/uploadsAjax.php, modules/Dashboard/DashboardAjax.php, modules/Potentials/PotentialsAjax.php, modules/Notes/NotesAjax.php, modules/Faq/FaqAjax.php, modules/Quotes/QuotesAjax.php, modules/Utilities/UtilitiesAjax.php, modules/Calendar/ActivityAjax.php, modules/Calendar/CalendarAjax.php, modules/PurchaseOrder/PurchaseOrderAjax.php, modules/HelpDesk/HelpDeskAjax.php, modules/Invoice/InvoiceAjax.php, modules/Accounts/AccountsAjax.php, modules/Reports/ReportsAjax.php, modules/Contacts/ContactsAjax.php, and modules/Portal/PortalAjax.php; and allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the step parameter in an Import action to the (4) Accounts, (5) Contacts, (6) HelpDesk, (7) Leads, (8) Potentials, (9) Products, or (10) Vendors module, reachable through index.php and related to modules/Import/index.php and multiple Import.php files. A remote attacker can use (1) module parameters to graph.php; or (2) modules or (3) include/Ajax/CommonAjax.php from modules/Campaigns/CampaignsAjax.php, modules/SalesOrder/SalesOrderAjax
| VAR-200909-0582 | No CVE | Nginx proxy DNS cache domain spoofing vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Nginx is a multi-platform HTTP server and mail proxy server. Nginx maintains an internal DNS cache for the parsed domain name, but in the search cache, nginx only checks if the name's crc32 matches and the short name is a long name prefix, but does not check if the names are equal in length. If nginx is configured as a proxy cache, the remote attacker can spoof the domain name through DNS poisoning attacks, tricking the user into believing that the domain name being accessed is legitimate.
This issue can be exploited when nginx is configured to act as a forward proxy, but this is a nonstandard and unsupported configuration. Attacks against other configurations may also be possible.
Successful exploits may allow remote attackers to intercept traffic intended for legitimate websites, which may aid in further attacks
| VAR-200910-0280 | CVE-2009-2684 |
HP LaserJet upper Jetdirect Cross-site scripting vulnerability
Related entries in the VARIoT exploits database: VAR-E-200910-0253 |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script. (1) support_param.html/config To script Apply In action Product_URL Parameters (2) support_param.html/config To script Apply In action Tech_URL Parameters. Multiple HP printers are prone to multiple cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01841397
Version: 1
HPSBPI02463 SSRT090061 rev.1 - HP LaserJet Printers, HP Color LaserJet Printers, Remote Cross Site Scripting (XSS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. The vulnerabilities could be exploited remotely by Cross Site Scripting (XSS).
References: CVE-2009-2684
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2009-2684 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
The Hewlett-Packard Company thanks Digital Security Research Group (dsecrg.com) for reporting these vulnerabilities to security-alert@hp.com.
Affected Products - Jetdirect
Product
Jetdirect Part Number
Jetdirect Version or later
HP Color LaserJet 3000n
J7949E
V.28.XX
HP Color LaserJet CP3505
J7987E
V.34.60
HP Color LaserJet 3600n
J7973E
V.30.31
HP Color LaserJet 3800n
J7949E
V.28.XX
HP Color LaserJet 4700n
J7949E
V.28.XX
HP Color LaserJet CP4005n
J7990E
V.33.41
HP LaserJet 2410/2420/2430n
J7949E
V.28.XX
HP LaserJet P3005n
J7979E
V.33.55
HP LaserJet 4240/4250n
J7949E
V.28.XX
HP LaserJet 4350n
J7949E
V.28.XX
HP LaserJet 5200n
J7949E
V.28.XX
HP LaserJet 9040n/9050n
J7949E
V.28.XX
HP Color LaserJet 4730 MFP
J7949E
V.28.XX
HP Color LaserJet CM4730 MFP
J7991E
V.34.60
HP LaserJet 9040/9050MFP
J7949E
V.28.XX
HP LaserJet M3027/3035 MFP
J7982E
V.34.08
HP LaserJet 4345 MFP
J7949E
V.28.XX
HP LaserJet M4345x MFP
J7982E
V.34.08
HP LaserJet M5025/5035 MFP
J7982E
V.34.08
HP CM8050/8060 MFP
J7974E
V.34.40
HP DS9200c Digital Sender
J7949E
V.28.XX
HP DS9250c Digital Sender
J7992E
V.34.12
HP LaserJet P4515
J8003E
V.36.35
HP LaserJet P4015
J8003E
V.36.35
HP LaserJet P4014
J8006E
V.36.35
HP Color LaserJet CP6015
J7993E
V.36.35
HP Color LaserJet 6040 MFP
J7993E
V.36.35
HP LaserJet M9040/50 MFP
J8004E
V.36.35
Affected Products - Embedded Web Server (EWS)
Product
HP Color LaserJet 3000n
HP Color LaserJet CP3505
HP Color LaserJet 3600n
HP Color LaserJet 3800n
HP Color LaserJet 4700n
HP Color LaserJet CP4005n
HP LaserJet 2410/2420/2430n
HP LaserJet P3005n
HP LaserJet 4240/4250n
HP LaserJet 4350n
HP LaserJet 5200n
HP LaserJet 9040n/9050n
HP Color LaserJet 4730 MFP
HP Color LaserJet CM4730 MFP
HP LaserJet 9040/9050MFP
HP LaserJet M3027/3035 MFP
HP LaserJet 4345 MFP
HP LaserJet M4345x MFP
HP LaserJet M5025/5035 MFP
HP CM8050/8060 MFP
HP DS9200c Digital Sender
HP DS9250c Digital Sender
HP LaserJet P4515
HP LaserJet P4015
HP LaserJet P4014
HP Color LaserJet CP6015
HP Color LaserJet 6040 MFP
HP LaserJet M9040/50 MFP
Note: For further information on Secure Printing and Imaging please refer to http://www.hp.com/go/secureprinting
RESOLUTION
The following steps can be taken to limit the exposure to the XSS vulnerabilities.
set the administrator password
use a new browser instance for administrator tasks
do not access other web sites while performing administrator tasks
exit the browser when administrator tasks are complete
PRODUCT SPECIFIC INFORMATION
None
HISTORY
Version:1 (rev.1) - 7 October 2009 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
-check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
-verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin
relates to is represented by the 5th and 6th characters
of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (HP-UX)
iEYEARECAAYFAkrMkcsACgkQ4B86/C0qfVkloACeJjXFqi/GNPBY7Z/Zn5bkBchG
RhUAoInJdnRoqTTCkgJqrss2Etcz9ool
=xes/
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
KSP Sound Player "m3u" Playlist Buffer Overflow
SECUNIA ADVISORY ID:
SA36621
VERIFY ADVISORY:
http://secunia.com/advisories/36621/
DESCRIPTION:
hack4love has discovered a vulnerability in KSP Sound Player, which
can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the processing
of "m3u" files. This can be exploited to cause a stack-based buffer
overflow when a user is tricked into opening a specially crafted
"m3u" playlist file containing an overly long entry.
Successful exploitation allows execution of arbitrary code.
SOLUTION:
Do not open files from untrusted sources.
PROVIDED AND/OR DISCOVERED BY:
hack4love
ORIGINAL ADVISORY:
http://milw0rm.com/exploits/9624
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
Input passed via the "Product_URL" and "Tech_URL" parameters to
support_param.html/config is not properly sanitised before being
used.
SOLUTION:
Filter malicious characters and character sequences in a web proxy.
See the vendor's advisory for recommended workarounds.
Details
*******
Multiple Linked Stored XSS vulnerabilities found in script support_param.html/config
Attacker can inject XSS in parameters "Product_URL" and "Tech_URL".
http://dsecrg.ru/pages/vul/show.php?id=148
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01841397
About
*****
Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com
Polyakov Alexandr
Information Security Analyst
______________________
DIGITAL SECURITY
phone: +7 812 703 1547
+7 812 430 9130
e-mail: a.polyakov@dsec.ru
www.dsec.ru
-----------------------------------
This message and any attachment are confidential and may be privileged or otherwise protected
from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure
is strictly prohibited. If you have received this message in error, please notify the sender immediately
either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence
via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding
statements by e-mail unless otherwise agreed.
-----------------------------------
| VAR-200909-0102 | CVE-2008-7229 | GreenSQL Firewall In SQL Vulnerability bypassing injection protection mechanism |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
GreenSQL Firewall (greensql-fw) before 0.9.2 allows remote attackers to bypass SQL injection protection via a crafted string, possibly involving an encoded space character (%20). Greensql Firewall is prone to a sql-injection vulnerability
| VAR-200909-0584 | No CVE | Multiple Vulnerabilities in Hitachi JP1/File Transmission Server/FTP |
CVSS V2: 10.0 CVSS V3: - Severity: High |
Hitachi JP1/File Transmission Server/FTP contains multiple vulnerabilities that could allow an attacker to execute arbitrary commands.A remote attacker could execute arbitrary commands.