PT-2010-3247 · Cisco · Cisco Content Services Switch (Css) 11500+1

Published 2010-07-06 · Updated 2018-10-10 · CVE-2010-1576

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Content Services Switch (CSS) 11500 versions prior to 8.20.4.02 Cisco Application Control Engine (ACE) 4710 versions prior to A2(3.0)

Description The issue arises from improper handling of line feed (LF), carriage return (CR), and LFCR as alternatives to the standard CRLF sequence between HTTP headers. This allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data. For example, using LF characters before ClientCert-Subject and ClientCert-Subject-CN headers.

Recommendations For Cisco Content Services Switch (CSS) 11500 versions prior to 8.20.4.02, update to version 8.20.4.02 or later. For Cisco Application Control Engine (ACE) 4710 versions prior to A2(3.0), update to version A2(3.0) or later. As a temporary workaround, consider restricting the use of LF, CR, and LFCR characters in HTTP headers to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-1576

Affected Products

Cisco Application Control Engine (Ace) 4710

Cisco Content Services Switch (Css) 11500

References · 8

• 🔥 http://vsecurity.com/resources/advisory/20100702-1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1576 · Security Note
• http://securitytracker.com/id?1024168 · Note
• http://securityfocus.com/archive/1/512144/100/0/threaded · Note
• http://osvdb.org/66092 · Note
• http://securityfocus.com/bid/41315 · Note
• http://securitytracker.com/id?1024167 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1576 · Note