ID
VAR-200906-0070
CVE
CVE-2009-1203
TITLE
Cisco Adaptive Security Appliances (ASA) Device WebVPN In WebVPN Vulnerability that makes it easy to send certificates
Trust: 0.8
DESCRIPTION
WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to trick a user into sending WebVPN credentials to an arbitrary server via a URL associated with that server, aka Bug ID CSCsy80709. Cisco Adaptive Security Appliance (ASA) is prone to a vulnerability that can aid in phishing attacks. An attacker can exploit this issue to display a fake login window that's visually similar to the device's login window, which may mislead users. This issue is tracked by Cisco Bug ID CSCsy80709. The attacker can exploit this issue to set up phishing attacks. Successful exploits could aid in further attacks. Versions prior to ASA 8.0.4.34 and 8.1.2.25 are vulnerable. Trustwave's SpiderLabs Security Advisory TWSL2009-002: Cisco ASA Web VPN Multiple Vulnerabilities Published: 2009-06-24 Version: 1.0 Vendor: Cisco Systems, Inc. (http://www.cisco.com) Versions affected: 8.0(4), 8.1.2, and 8.2.1 Description: Cisco's Adaptive Security Appliance (ASA) provides a number of security related features, including "Web VPN" functionality that allows authenticated users to access a variety of content through a web interface. This includes other web content, FTP servers, and CIFS file servers. The web content is proxied by the ASA and rewritten so that any URLs in the web content are passed as query parameters sent to the ASA web interface. Where scripting content is present, the ASA places a JavaScript wrapper around the original webpage's Document Object Model (DOM), to prevent the webpage from accessing the ASA's DOM. Credit: David Byrne of Trustwave's SpiderLabs Finding 1: Post-Authentication Cross-Site Scripting CVE: CVE-2009-1201 The ASA's DOM wrapper can be rewritten in a manner to allow Cross-Site Scripting (XSS) attacks. For example, the "csco_wrap_js" JavaScript function in /+CSCOL+/cte.js makes a call to a function referenced by "CSCO_WebVPN['process']". The result of this call is then used in an "eval" statement. function csco_wrap_js(str) { var ret="<script id=CSCO_GHOST src="+CSCO_Gateway+ "/+CSCOL+/cte.js></scr"+ "ipt><script id=CSCO_GHOST src="+ CSCO_Gateway+"/+CSCOE+/apcf></sc"+"ript>"; var js_mangled=CSCO_WebVPN['process']('js',str); ret+=CSCO_WebVPN['process']('html',eval(js_mangled)); return ret; }; To exploit this behavior, a malicious page can rewrite "CSCO_WebVPN['process']" with an attacker-defined function that will return an arbitrary value. The next time the "csco_wrap_js" function is called, the malicious code will be executed. Below is a proof of concept. <html><script> function a(b, c) { return "alert('Your VPN location:\\n\\n'+" + "document.location+'\\n\\n\\n\\n\\n" + "Your VPN cookie:\\n\\n'+document.cookie);"; } CSCO_WebVPN['process'] = a; csco_wrap_js(''); </script></html> Vendor Response: This vulnerability has been corrected in versions 8.0.4.34, and 8.1.2.25. Updated Cisco ASA software can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/ASAPSIRT A vendor response will be posted at http://www.cisco.com/security This vulnerability is documented in Cisco Bug ID: CSCsy80694. CVSS Score: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:U/RC:C Base: 4.3 Temporal: 3.9 Finding 2: HTML Rewriting Bypass CVE: CVE-2009-1202 When a webpage is requested through the ASA's Web VPN, the targeted scheme and hostname is Rot13-encoded, then hex-encoded and placed in the ASA's URL. For example, "http://www.trustwave.com" is accessed by requesting the following ASA path: /+CSCO+0075676763663A2F2F6A6A6A2E67656866676A6E69722E70627A+ +/ The HTML content of this request is obviously reformatted by the ASA, starting at the very beginning: <script id='CSCO_GHOST' src="/+webvpn+/toolbar.js"> However, if the request URL is modified to change the initial hex value of "00" to "01", the HTML document is returned without any rewriting. This allows the pages scriptable content to run in the ASA's DOM, making Cross-Site Scripting trivial. Vendor Response: This vulnerability has been corrected in versions 8.0.4.34, and 8.1.2.25. Updated Cisco ASA software can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/ASAPSIRT A vendor response will be posted at http://www.cisco.com/security This vulnerability is documented in Cisco Bug ID: CSCsy80705. CVSS Score: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:U/RC:C Base: 4.3 Temporal: 3.9 Finding 3: Authentication Credential Theft CVE: CVE-2009-1203 When a user accesses an FTP or CIFS destination using the Web VPN, the resulting URL is formatted in a similar manner as the web requests described above. The following URL attempts to connect to ftp.example.com; normally, it would be in an HTML frame within the Web VPN website. /+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F736763 2e726b6e7a6379722e70627a The ASA first attempts to connect to the FTP server or CIFS share using anonymous credentials. If those fail, the user is prompted for login credentials. When viewed on its own (outside of a frame), the submission form gives no indication what it is for and is very similar in appearance to the Web VPN's primary login page. If the URL was sent to a user by an attacker, it is very possible that a user would assume that he needs to resubmit credentials to the Web VPN. The ASA would then forward the credentials to the attacker's FTP or CIFS server. Vendor Response: This vulnerability has been corrected in versions 8.0.4.34, and 8.1.2.25. Updated Cisco ASA software can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/ASAPSIRT A vendor response will be posted at http://www.cisco.com/security This vulnerability is documented in Cisco Bug ID: CSCsy80709. CVSS Score: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:U/RC:C Base: 4.3 Temporal: 3.9 Vendor Communication Timeline: 03/31/09 - Cisco notified of vulnerabilities 06/24/09 - Cisco software updates released; Advisory released Remediation Steps: Install updated software from Cisco. Revision History: 1.0 Initial publication About Trustwave: Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations--ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers--manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, China and Australia. For more information, visit https://www.trustwave.com About Trustwave's SpiderLabs: SpiderLabs is the advance security team at Trustwave responsible for incident response and forensics, ethical hacking and application security tests for Trustwave's clients. SpiderLabs has responded to hundreds of security incidents, performed thousands of ethical hacking exercises and tested the security of hundreds of business applications for Fortune 500 organizations. For more information visit https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Cisco ASA WebVPN Multiple Vulnerabilities SECUNIA ADVISORY ID: SA35511 VERIFY ADVISORY: http://secunia.com/advisories/35511/ DESCRIPTION: Some vulnerabilities and a security issue have been reported in Cisco Adaptive Security Appliance (ASA), which can be exploited by malicious people to conduct cross-site scripting and spoofing attacks. 1) Input passed within web pages is not properly sanitised before being used in a call to eval() in context of the VPN web portal. This can be exploited to execute arbitrary HTML and script code in user's browser session in context of the WebVPN. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of the VPN web portal. 3) A security issue exists in the handling of Common Internet File System (CIFS) and FTP shares in the SSL VPN feature. This can be exploited to conduct spoofing attacks and potentially disclose the user's credentials if a user follows a specially crafted link. The vulnerabilities are reported in versions prior to 8.0.4(34), 8.1.2(25), and 8.2.1(3) that are configured to accept Clientless SSL VPN connections. SOLUTION: Update to version 8.0.4(34), 8.1.2(25), or 8.2.1(3). http://www.cisco.com/pcgi-bin/tablebuild.pl/ASAPSIRT PROVIDED AND/OR DISCOVERED BY: David Byrne, Trustwave's SpiderLabs ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=18373 http://tools.cisco.com/security/center/viewAlert.x?alertId=18442 http://tools.cisco.com/security/center/viewAlert.x?alertId=18536 Trustwave: https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
Trust: 2.16
AFFECTED PRODUCTS
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.2.1 | Trust: 2.7 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.1.2 | Trust: 2.7 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.0\(4\) | Trust: 1.6 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.0(4) | Trust: 1.1 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | * | Trust: 1.0 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.0.211 | Trust: 0.3 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.1(2)19 | Trust: 0.3 |
| vendor: | cisco | model: | adaptive security appliance | scope: | eq | version: | 8.1(2)14 | Trust: 0.3 |
| vendor: | cisco | model: | adaptive security appliance | scope: | ne | version: | 8.2.13 | Trust: 0.3 |
| vendor: | cisco | model: | adaptive security appliance | scope: | ne | version: | 8.1.2.25 | Trust: 0.3 |
| vendor: | cisco | model: | adaptive security appliance | scope: | ne | version: | 8.0.4.34 | Trust: 0.3 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-Other | Trust: 1.0 |
| problemtype: | CWE-Other | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
other
Trust: 0.6
CONFIGURATIONS
EXPLOIT AVAILABILITY
PATCH
| title: | 18536 | url: | http://tools.cisco.com/security/center/viewAlert.x?alertId=18536 | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2009-1203 | Trust: 2.9 |
| db: | BID | id: | 35475 | Trust: 2.8 |
| db: | SECUNIA | id: | 35511 | Trust: 1.2 |
| db: | SECTRACK | id: | 1022457 | Trust: 1.1 |
| db: | VUPEN | id: | ADV-2009-1713 | Trust: 1.1 |
| db: | JVNDB | id: | JVNDB-2009-001871 | Trust: 0.8 |
| db: | BUGTRAQ | id: | 20090624 TRUSTWAVE'S SPIDERLABS SECURITY ADVISORY TWSL2009-002 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-200906-388 | Trust: 0.6 |
| db: | SEEBUG | id: | SSVID-86309 | Trust: 0.1 |
| db: | EXPLOIT-DB | id: | 33054 | Trust: 0.1 |
| db: | VULHUB | id: | VHN-38649 | Trust: 0.1 |
| db: | PACKETSTORM | id: | 78639 | Trust: 0.1 |
| db: | PACKETSTORM | id: | 78856 | Trust: 0.1 |
REFERENCES
| url: | http://www.securityfocus.com/bid/35475 | Trust: 2.5 |
| url: | http://www.securityfocus.com/archive/1/504516/100/0/threaded | Trust: 1.1 |
| url: | http://www.securitytracker.com/id?1022457 | Trust: 1.1 |
| url: | http://secunia.com/advisories/35511 | Trust: 1.1 |
| url: | http://www.vupen.com/english/advisories/2009/1713 | Trust: 1.1 |
| url: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1203 | Trust: 0.8 |
| url: | http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-1203 | Trust: 0.8 |
| url: | http://www.securityfocus.com/archive/1/archive/1/504516/100/0/threaded | Trust: 0.6 |
| url: | http://tools.cisco.com/security/center/viewalert.x?alertid=18536 | Trust: 0.4 |
| url: | https://www.trustwave.com/spiderlabs/advisories/twsl2009-002.txt | Trust: 0.4 |
| url: | http://www.cisco.com/en/us/products/ps6120/index.html | Trust: 0.3 |
| url: | /archive/1/504516 | Trust: 0.3 |
| url: | http://www.cisco.com/pcgi-bin/tablebuild.pl/asapsirt | Trust: 0.2 |
| url: | http://www.trustwave.com" | Trust: 0.1 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2009-1202 | Trust: 0.1 |
| url: | https://www.trustwave.com/spiderlabs | Trust: 0.1 |
| url: | http://secunia.com/ | Trust: 0.1 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2009-1203 | Trust: 0.1 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2009-1201 | Trust: 0.1 |
| url: | http://www.cisco.com/security | Trust: 0.1 |
| url: | http://lists.grok.org.uk/full-disclosure-charter.html | Trust: 0.1 |
| url: | http://www.cisco.com) | Trust: 0.1 |
| url: | https://www.trustwave.com | Trust: 0.1 |
| url: | http://secunia.com/advisories/secunia_security_advisories/ | Trust: 0.1 |
| url: | http://secunia.com/advisories/business_solutions/ | Trust: 0.1 |
| url: | http://secunia.com/advisories/35511/ | Trust: 0.1 |
| url: | http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org | Trust: 0.1 |
| url: | http://tools.cisco.com/security/center/viewalert.x?alertid=18442 | Trust: 0.1 |
| url: | http://tools.cisco.com/security/center/viewalert.x?alertid=18373 | Trust: 0.1 |
| url: | http://secunia.com/advisories/about_secunia_advisories/ | Trust: 0.1 |
CREDITS
David Byrne davidribyrne@yahoo.com
Trust: 0.6
SOURCES
| db: | VULHUB | id: | VHN-38649 |
| db: | BID | id: | 35475 |
| db: | JVNDB | id: | JVNDB-2009-001871 |
| db: | PACKETSTORM | id: | 78639 |
| db: | PACKETSTORM | id: | 78856 |
| db: | CNNVD | id: | CNNVD-200906-388 |
| db: | NVD | id: | CVE-2009-1203 |
LAST UPDATE DATE
2024-11-23T22:43:03.257000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-38649 | date: | 2018-10-10T00:00:00 |
| db: | BID | id: | 35475 | date: | 2009-06-26T13:49:00 |
| db: | JVNDB | id: | JVNDB-2009-001871 | date: | 2009-08-12T00:00:00 |
| db: | CNNVD | id: | CNNVD-200906-388 | date: | 2009-06-26T00:00:00 |
| db: | NVD | id: | CVE-2009-1203 | date: | 2024-11-21T01:01:54.117 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-38649 | date: | 2009-06-25T00:00:00 |
| db: | BID | id: | 35475 | date: | 2009-06-24T00:00:00 |
| db: | JVNDB | id: | JVNDB-2009-001871 | date: | 2009-08-12T00:00:00 |
| db: | PACKETSTORM | id: | 78639 | date: | 2009-06-25T00:37:57 |
| db: | PACKETSTORM | id: | 78856 | date: | 2009-07-01T09:39:17 |
| db: | CNNVD | id: | CNNVD-200906-388 | date: | 2009-06-25T00:00:00 |
| db: | NVD | id: | CVE-2009-1203 | date: | 2009-06-25T17:30:00.267 |