PT-2009-1000 · Cisco · Cisco Ios

Adrian Pastor · Published 2009-01-14 · Updated 2018-10-11 · CVE-2008-3821

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 11.0 through 12.4

Description The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the ping program or other aspects of the URI, due to an input sanitization error in the embedded HTTP server. This could enable an unauthenticated, remote attacker to execute arbitrary HTML and script code in the user's browser session by convincing a user to follow a malicious link.

Recommendations For Cisco IOS versions 11.0 through 12.4, update to the latest software version that includes the fix for this issue. As a temporary workaround, consider disabling the embedded HTTP server when it is not in use to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2014-00327

CVE-2008-3821

Affected Products

Cisco Ios

References · 16

• 🔥 http://procheckup.com/vulnerability_manager/vulnerabilities/pr08-19 · Exploit
• 🔥 https://exploit-db.com/exploits/32723 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3821 · Security Note
• https://bdu.fstec.ru/vul/2014-00327 · Security Note
• http://cisco.com/en/US/products/products_security_response09186a0080a5c501.html · Vendor Advisory
• http://secunia.com/advisories/33461 · Note
• http://securityfocus.com/archive/1/500063/100/0/threaded · Note
• http://vupen.com/english/advisories/2009/0138 · Note
• http://securitytracker.com/id?1021598 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47947 · Note
• http://osvdb.org/51393 · Note
• http://securityreason.com/securityalert/4916 · Note
• http://securityfocus.com/bid/33260 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20090114-CVE-2008-3821 · Note
• http://osvdb.org/51394 · Note