CERT-In Vulnerability Note
CIVN-2007-0149
CiscoWorks Server XSS Vulnerability
Original Issue Date:December 11, 2007
Severity Rating: HIGH
Systems Affected
- CiscoWorks Common Services 3.0.x
- CiscoWorks Common Services 3.1
Both windows and Solaris Platforms
Overview
CiscoWorks is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Description
Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. This vulnerability can be exploited by attackers to bypass access controls.
Cisco-Works is a network monitoring tool which and it works with all kind of Cisco devices. It is vulnerable to Cross Site Scripting XSS attacks from the Cisco-Works Server login page, http:// server-name : portnumber . When this XSS vulnerability is exploited, malicious code or script is embedded within the URL and associated with an unsuccessful login attempt page. An attacker could try to convince an unsuspecting user to follow a malicious link created by an embedded malicious code to a vulnerable Cisco-Works server that injects reflects the malicious code into the users browser.
Solution
Apply appropriate patches provided by Cisco. The patches are available for registered customers at:
http://www.cisco.com/cgi-bin/tablebuild.pl/cw2000-cd-one
Vendor Information
Cisco
http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml
References
Liquid Matrix
http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/
CSIRTUK
http://www.cpni.gov.uk/Products/alerts/3510.aspx
Secunia
http://secunia.com/advisories/27902/
SecurityLab
http://en.securitylab.ru/notification/309456.php
AusCert
https://www.auscert.org.au/render.html?it=8460
SecurityFocus
http://www.securityfocus.com/bid/26708
Cisco
http://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|