CERT-In Vulnerability Note CIVN-2009-09
Cisco IOS Cross-Site Scripting Vulnerabilities

Original Issue Date:January 20, 2009

Severity Rating: High

Systems Affected

• Cisco IOS 12.x

Overview

Two vulnerabilities have been reported in Cisco IOS Software that could allow an unauthenticated, remote attacker to execute arbitrary HTML and script code in the user's browser session.

Description

These vulnerabilities exist because of input validation errors in the HTTP server when processing user-supplied parameters via the "ping" command . An unauthenticated, remote attacker could exploit this to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, access data recently submitted by the target user, or take actions on the site acting as the target user.

Successful exploitation of these vulnerabilities requires that the HTTP server or secure server is enabled.

Workarounds

• Disable the HTTP server if it is not necessary for business operations.
• Apply access control lists to restrict access to the HTTP server.

Solution

Upgrade to fixed versions as suggested by vendor at:
http://www.cisco.com/warp/public/707/cisco-sr-20090114
-http.shtml#add

Vendor Information

CISCO
http://www.cisco.com/warp/public/707/cisco-sr-20090114-http.shtml
http://www.cisco.com/en/US/products/products_security_response
09186a0080a5c501.html

References

SecurityFocus
http://www.securityfocus.com/bid/33260

SecurityTracker
http://securitytracker.com/alerts/2009/Jan/1021598.html

ISS XFORCE
http://xforce.iss.net/xforce/xfdb/47947

CVE Name
CVE-2008-3821


Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003