IPdiva SSL VPN Security Bypass Vulnerability and Multiple Cross Site Scripting Vulnerabilities
BID:27800
Info
IPdiva SSL VPN Security Bypass Vulnerability and Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 27800 |
| Class: | Unknown |
| CVE: |
CVE-2008-0915 CVE-2008-0914 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 14 2008 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | Ha.ckers.fr Team discovered these vulnerabilities. |
| Vulnerable: |
IPdiva IPdiva 2.3 IPdiva IPdiva 2.2 |
| Not Vulnerable: |
IPdiva IPdiva 2.3.2.14 IPdiva IPdiva 2.2.8.84 |
Discussion
IPdiva SSL VPN Security Bypass Vulnerability and Multiple Cross Site Scripting Vulnerabilities
IPdiva SSL VPN is prone to a security-mechanism bypass vulnerability and multiple unspecified cross-site scripting vulnerabilities.
An attacker can exploit these issues to gain unauthorized access to resources protected by the VPN, or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
These issues affect IPdiva SSL VPN 2.2 branch prior to 2.2.8.84 and 2.3 branch prior to 2.3.2.14.
IPdiva SSL VPN is prone to a security-mechanism bypass vulnerability and multiple unspecified cross-site scripting vulnerabilities.
An attacker can exploit these issues to gain unauthorized access to resources protected by the VPN, or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
These issues affect IPdiva SSL VPN 2.2 branch prior to 2.2.8.84 and 2.3 branch prior to 2.3.2.14.
Exploit / POC
IPdiva SSL VPN Security Bypass Vulnerability and Multiple Cross Site Scripting Vulnerabilities
An attacker can exploit these issues with readily available network tools. To exploit the cross-site scripting issues, an attacker must entice an unsuspecting victim into following a malicious URI.
An attacker can exploit these issues with readily available network tools. To exploit the cross-site scripting issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
IPdiva SSL VPN Security Bypass Vulnerability and Multiple Cross Site Scripting Vulnerabilities
Solution:
The vendor released IPdiva 2.2.8.84 and 2.3.2.14 to address these issues. Please see the references and contact the vendor for information on how to obtain and apply the fixes.
Solution:
The vendor released IPdiva 2.2.8.84 and 2.3.2.14 to address these issues. Please see the references and contact the vendor for information on how to obtain and apply the fixes.
References
IPdiva SSL VPN Security Bypass Vulnerability and Multiple Cross Site Scripting Vulnerabilities
References:
References: