PT-2009-1000 · Cisco · Cisco Ios

Adrian Pastor · Publicado 2009-01-14 · Atualizado 2018-10-11 · CVE-2008-3821

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 11.0 through 12.4

Description The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the ping program or other aspects of the URI, due to an input sanitization error in the embedded HTTP server. This could enable an unauthenticated, remote attacker to execute arbitrary HTML and script code in the user's browser session by convincing a user to follow a malicious link.

Recommendations For Cisco IOS versions 11.0 through 12.4, update to the latest software version that includes the fix for this issue. As a temporary workaround, consider disabling the embedded HTTP server when it is not in use to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2014-00327

CVE-2008-3821

Produtos afetados

Cisco Ios

Referências · 16

• 🔥 http://procheckup.com/vulnerability_manager/vulnerabilities/pr08-19 · Exploit
• 🔥 https://exploit-db.com/exploits/32723 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3821 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00327 · Nota de Segurança
• http://secunia.com/advisories/33461 · Nota
• http://securityfocus.com/archive/1/500063/100/0/threaded · Nota
• http://vupen.com/english/advisories/2009/0138 · Nota
• http://securitytracker.com/id?1021598 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47947 · Nota
• http://osvdb.org/51393 · Nota
• http://securityreason.com/securityalert/4916 · Nota
• http://cisco.com/en/US/products/products_security_response09186a0080a5c501.html · Aviso do Fabricante
• http://securityfocus.com/bid/33260 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20090114-CVE-2008-3821 · Nota
• http://osvdb.org/51394 · Nota