PT-2009-3747 · Cisco · Cisco Asa

Publicado 2009-06-24 · Atualizado 2018-10-10 · CVE-2009-1203

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliances (ASA) versions prior to 8.0.4(34) Cisco Adaptive Security Appliances (ASA) versions prior to 8.1.2(25) Cisco Adaptive Security Appliances (ASA) versions prior to 8.2.1(3)

Description The issue allows remote attackers to trick a user into sending WebVPN credentials to an arbitrary server via a URL associated with that server. This is due to the WebVPN on the Cisco Adaptive Security Appliances (ASA) device not properly distinguishing its own login screen from the login screens it produces for third-party servers, such as FTP and CIFS servers. An unauthenticated, remote attacker could steal user account credentials if the device has been configured to accept Clientless SSL VPN connections.

Recommendations For versions prior to 8.0.4(34), update to version 8.0.4(34) or later. For versions prior to 8.1.2(25), update to version 8.1.2(25) or later. For versions prior to 8.2.1(3), update to version 8.2.1(3) or later.

Exploit

Correção

Identificadores relacionados

CVE-2009-1203

Produtos afetados

Cisco Asa

Referências · 9

• 🔥 https://exploit-db.com/exploits/33054 · Exploit
• 🔥 http://securityfocus.com/bid/35475 · Exploit
• http://securitytracker.com/id?1022457 · Nota
• http://vupen.com/english/advisories/2009/1713 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1203 · Nota de Segurança
• http://secunia.com/advisories/35511 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20090624-CVE-2009-1203 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1203 · Nota
• http://securityfocus.com/archive/1/504516/100/0/threaded · Nota