ID

VAR-200902-0202

CVE

CVE-2008-6096

TITLE

Juniper NetScreen ScreenOS Vulnerable to cross-site scripting

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page. ScreenOS is prone to an HTML-injection vulnerability because its administrative web interface fails to sufficiently sanitize user-supplied input data. Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. The issue affects ScreenOS 5.4.0r9.0. Juniper NetScreen ScreenOS is the core operating system of NetScreen firewall and other network products. Juniper NetScreen ScreenOS versions earlier than 5.4r10, 6.0r6 and 6.1r2 have a cross-site scripting vulnerability. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Juniper NetScreen ScreenOS Script Insertion Vulnerability SECUNIA ADVISORY ID: SA32078 VERIFY ADVISORY: http://secunia.com/advisories/32078/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: >From remote OPERATING SYSTEM: NetScreen ScreenOS 5.x http://secunia.com/advisories/product/2569/ NetScreen ScreenOS 6.x http://secunia.com/advisories/product/18925/ DESCRIPTION: A vulnerability has been reported in Juniper NetScreen ScreenOS, which can be exploited by malicious people to conduct script insertion attacks. This can be exploited to insert arbitrary HTML and script code, which will be executed in another user's browser session in context of the web interface when the event logs are viewed. The vulnerability is reported in version 5.4.0r9.0 and reportedly also affects versions prior to 6.0r6 and 6.1r2. SOLUTION: Update to version 5.4r10, 6.0r6, or 6.1r2. PROVIDED AND/OR DISCOVERED BY: Deral Heiland, Layered Defense ORIGINAL ADVISORY: Layered Defense: http://www.layereddefense.com/netscreen01oct.html Juniper (login required): https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-009&viewMode=view ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

XSS

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Deral Heiland

SOURCES

LAST UPDATE DATE

2024-11-23T22:57:01.884000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE