PT-2008-3546 · Mozilla+2 · Firefox+2

Richard Brain · Published 2008-04-30 · Updated 2018-10-11 · CVE-2008-2027

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions RSA Authentication Agent version 5.3.0.258 for Web for IIS

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via an ftp URL in the url parameter to a Redirect action, particularly when accessed through certain browsers like Mozilla Firefox.

Recommendations For RSA Authentication Agent version 5.3.0.258 for Web for IIS, consider restricting access to the Redirect action or validating the url parameter to prevent redirects to unauthorized sites. As a temporary workaround, avoid using the url parameter in the Redirect action until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-2027

Affected Products

Iis

Firefox

Rsa Authentication Agent

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-2027 · Security Note
• http://securityreason.com/securityalert/3850 · Note
• http://securityfocus.com/bid/28907 · Note
• http://procheckup.com/Vulnerability_PR07-43.php · Note
• http://securityfocus.com/archive/1/491237/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42184 · Note