|
|
|
|
| |
Credit:
The information has been provided by Daniel King.
The original article can be found at: http://seclists.org/bugtraq/2010/Jun/231
|
| |
Vulnerable Systems:
* Cisco ASA version 8.1(1) and earlier
Immune Systems:
* Cisco ASA version 8.1(2)
The vulnerability is caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the Adaptive Security Appliance site. When a user connects to the web interface of the ASA via HTTP, they are automatically redirected to the SSL encrypted version. The web server issues a 301 Moved Permanently status code to the connecting client to facilitate this redirection. If the client appends the carriage return (%0d) and line feed (%0a) characters to the URL, the web server will parse these and allow the client to inject arbitrary HTTP response headers. Using this method, it is possible to inject a second Location header to the client. The client web browser will act on only the last Location header it encounters and redirect there.
CVE Information:
CVE-2008-7257
Disclosure Timeline:
Thu, 24 Jun 2010 - Published
|
|
|
|
|
