Sign-up

ID

VAR-200606-0560


CVE

CVE-2006-2925


TITLE

Ingate Firewall/SIParator web interface Cross-site scripting attack (XSS) Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200606-199

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the web interface in Ingate Firewall before 4.4.1 and SIParator before 4.4.1 allows remote attackers to inject arbitrary web script or HTML, and steal cookies, via unspecified vectors related to "XSS exploits" in administrator functionality. ---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerability reports. http://secunia.com/secunia_security_specialist/ ---------------------------------------------------------------------- TITLE: Ingate Firewall and SIParator Two Vulnerabilities SECUNIA ADVISORY ID: SA20479 VERIFY ADVISORY: http://secunia.com/advisories/20479/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, DoS WHERE: >From remote OPERATING SYSTEM: Ingate SIParator 4.x http://secunia.com/product/5687/ Ingate Firewall 4.x http://secunia.com/product/4050/ DESCRIPTION: Two vulnerabilities have been reported in Ingate Firewall and SIParator, which can be exploited by malicious people to conduct cross-site scripting attacks and to cause a DoS (Denial of Service). 1) An error exists within the handling of SSL/TLS handshake in the SIP module and in the web server. This can be exploited to cause the modules to crash via a specially-crafted handshake. Successful exploitation requires that SSL/TLS is enabled. 2) Input passed to unspecified parameters in the web interface isn't properly sanitised before being returned to the user. SOLUTION: Update to version 4.4.1. http://www.ingate.com/upgrades.php PROVIDED AND/OR DISCOVERED BY: Reported by vendor. ORIGINAL ADVISORY: http://www.ingate.com/relnote-441.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.08

sources: NVD: CVE-2006-2925 // VULHUB: VHN-19033 // PACKETSTORM: 47098

AFFECTED PRODUCTS

vendor:ingatemodel:siparatorscope:eqversion:4.3.1

Trust: 1.6

vendor:ingatemodel:firewallscope:eqversion:4.3.1

Trust: 1.6

vendor:ingatemodel:firewallscope:lteversion:4.3.4

Trust: 1.0

vendor:ingatemodel:siparatorscope:lteversion:4.3.4

Trust: 1.0

vendor:ingatemodel:siparatorscope:eqversion:4.3.4

Trust: 0.6

vendor:ingatemodel:firewallscope:eqversion:4.3.4

Trust: 0.6

sources: CNNVD: CNNVD-200606-199 // NVD: CVE-2006-2925

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-2925
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200606-199
value: MEDIUM

Trust: 0.6

VULHUB: VHN-19033
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2006-2925
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-19033
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-19033 // CNNVD: CNNVD-200606-199 // NVD: CVE-2006-2925

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-2925

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200606-199

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 47098 // CNNVD: CNNVD-200606-199

EXTERNAL IDS

db:SECUNIAid:20479

Trust: 1.8

db:VUPENid:ADV-2006-2183

Trust: 1.7

db:NVDid:CVE-2006-2925

Trust: 1.7

db:SECTRACKid:1016244

Trust: 1.7

db:SECTRACKid:1016245

Trust: 1.7

db:CNNVDid:CNNVD-200606-199

Trust: 0.7

db:XFid:26978

Trust: 0.6

db:BIDid:83846

Trust: 0.1

db:VULHUBid:VHN-19033

Trust: 0.1

db:PACKETSTORMid:47098

Trust: 0.1

sources: VULHUB: VHN-19033 // PACKETSTORM: 47098 // CNNVD: CNNVD-200606-199 // NVD: CVE-2006-2925

REFERENCES

url:http://www.ingate.com/relnote-441.php

Trust: 1.8

url:http://securitytracker.com/id?1016244

Trust: 1.7

url:http://securitytracker.com/id?1016245

Trust: 1.7

url:http://secunia.com/advisories/20479

Trust: 1.7

url:http://www.vupen.com/english/advisories/2006/2183

Trust: 1.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/26978

Trust: 1.1

url:http://xforce.iss.net/xforce/xfdb/26978

Trust: 0.6

url:http://www.frsirt.com/english/advisories/2006/2183

Trust: 0.6

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/product/4050/

Trust: 0.1

url:http://secunia.com/product/5687/

Trust: 0.1

url:http://www.ingate.com/upgrades.php

Trust: 0.1

url:http://secunia.com/advisories/20479/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/secunia_security_specialist/

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: VULHUB: VHN-19033 // PACKETSTORM: 47098 // CNNVD: CNNVD-200606-199 // NVD: CVE-2006-2925

CREDITS

Secunia

Trust: 0.1

sources: PACKETSTORM: 47098

SOURCES

db:VULHUBid:VHN-19033
db:PACKETSTORMid:47098
db:CNNVDid:CNNVD-200606-199
db:NVDid:CVE-2006-2925

LAST UPDATE DATE

2024-11-23T22:28:31.972000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-19033date:2017-07-20T00:00:00
db:CNNVDid:CNNVD-200606-199date:2006-06-09T00:00:00
db:NVDid:CVE-2006-2925date:2024-11-21T00:12:25.020

SOURCES RELEASE DATE

db:VULHUBid:VHN-19033date:2006-06-09T00:00:00
db:PACKETSTORMid:47098date:2006-06-10T05:36:59
db:CNNVDid:CNNVD-200606-199date:2006-06-09T00:00:00
db:NVDid:CVE-2006-2925date:2006-06-09T10:02:00