PT-2009-3746 · Cisco · Cisco Asa

Published 2009-06-24 · Updated 2018-10-10 · CVE-2009-1202

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliances (ASA) versions prior to 8.0.4(34) Cisco Adaptive Security Appliances (ASA) versions prior to 8.1.2(25) Cisco Adaptive Security Appliances (ASA) versions prior to 8.2.1(3)

Description The issue allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks. This can be achieved by modifying the first hex-encoded character in a /+CSCO+ URI. The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary script or HTML code in a user's browser session.

Recommendations For versions prior to 8.0.4(34), update to version 8.0.4(34) or later. For versions prior to 8.1.2(25), update to version 8.1.2(25) or later. For versions prior to 8.2.1(3), update to version 8.2.1(3) or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1202

Affected Products

Cisco Asa

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-1202 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20090624-CVE-2009-1202 · Vendor Advisory
• http://securitytracker.com/id?1022457 · Note
• http://securityfocus.com/bid/35480 · Note
• http://vupen.com/english/advisories/2009/1713 · Note
• http://secunia.com/advisories/35511 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1202 · Note
• http://securityfocus.com/archive/1/504516/100/0/threaded · Note