PT-2009-3746 · Cisco · Cisco Asa

Publicado 2009-06-24 · Atualizado 2018-10-10 · CVE-2009-1202

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliances (ASA) versions prior to 8.0.4(34) Cisco Adaptive Security Appliances (ASA) versions prior to 8.1.2(25) Cisco Adaptive Security Appliances (ASA) versions prior to 8.2.1(3)

Description The issue allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks. This can be achieved by modifying the first hex-encoded character in a /+CSCO+ URI. The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary script or HTML code in a user's browser session.

Recommendations For versions prior to 8.0.4(34), update to version 8.0.4(34) or later. For versions prior to 8.1.2(25), update to version 8.1.2(25) or later. For versions prior to 8.2.1(3), update to version 8.2.1(3) or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-1202

Produtos afetados

Cisco Asa

Referências · 8

• http://securitytracker.com/id?1022457 · Nota
• http://securityfocus.com/bid/35480 · Nota
• http://vupen.com/english/advisories/2009/1713 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1202 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20090624-CVE-2009-1202 · Aviso do Fabricante
• http://secunia.com/advisories/35511 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1202 · Nota
• http://securityfocus.com/archive/1/504516/100/0/threaded · Nota