PT-2010-1248 · Cisco · Cisco Asa
Publicado
2010-06-25
·
Atualizado
2018-10-11
·
CVE-2008-7257
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Adaptive Security Appliances (ASA) 5580 series devices with software versions prior to 8.1(2)
Description
The issue allows remote attackers to inject arbitrary HTTP headers, as demonstrated by a redirect attack involving a
%0d%0aLocation%3a sequence in a URI. This can also be used to conduct HTTP response splitting attacks via unspecified vectors. Additionally, it could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks.Recommendations
For versions prior to 8.1(2), update to version 8.1(2) or later to resolve the issue. As a temporary workaround, consider restricting access to the
/+webvpn+/index.html endpoint to minimize the risk of exploitation. Avoid using the Location header in HTTP responses from the affected device until the issue is resolved.Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Asa