Cisco User-Changeable Password (UCP) 'CSuserCGI.exe' Multiple Remote Vulnerabilities
BID:28222
Info
Cisco User-Changeable Password (UCP) 'CSuserCGI.exe' Multiple Remote Vulnerabilities
| Bugtraq ID: | 28222 |
| Class: | Unknown |
| CVE: |
CVE-2008-0532 CVE-2008-0533 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 12 2008 12:00AM |
| Updated: | May 13 2008 10:45PM |
| Credit: | Felix 'FX' Lindner, Recurity Labs GmbH discovered these issues. |
| Vulnerable: |
Cisco User-Changeable Password (UCP) 3.3.4 .12.5 Cisco User-Changeable Password (UCP) 0 |
| Not Vulnerable: |
Cisco User-Changeable Password (UCP) 4.2 |
Discussion
Cisco User-Changeable Password (UCP) 'CSuserCGI.exe' Multiple Remote Vulnerabilities
Cisco User-Changeable Password (UCP) is prone to multiple remote vulnerabilities, including cross-site scripting and buffer-overflow vulnerabilities.
Exploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers.
The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205.
These issues affect versions prior to UCP 4.2 when running on Microsoft Windows.
Cisco User-Changeable Password (UCP) is prone to multiple remote vulnerabilities, including cross-site scripting and buffer-overflow vulnerabilities.
Exploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers.
The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205.
These issues affect versions prior to UCP 4.2 when running on Microsoft Windows.
Exploit / POC
Cisco User-Changeable Password (UCP) 'CSuserCGI.exe' Multiple Remote Vulnerabilities
An attacker can exploit the cross-site scripting issues by enticing an unsuspecting user to follow a malicious URI.
DSquare Security has developed a working commercial exploit for its D2 Exploitation Pack product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept URI demonstrates one of the buffer-overflow issues:
http://www.example.com/securecgi-bin/CSUserCGI.exe?Logout+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB.xyzab.c.hacker.
An attacker can exploit the cross-site scripting issues by enticing an unsuspecting user to follow a malicious URI.
DSquare Security has developed a working commercial exploit for its D2 Exploitation Pack product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept URI demonstrates one of the buffer-overflow issues:
http://www.example.com/securecgi-bin/CSUserCGI.exe?Logout+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB.xyzab.c.hacker.
Solution / Fix
Cisco User-Changeable Password (UCP) 'CSuserCGI.exe' Multiple Remote Vulnerabilities
Solution:
The vendor released UCP 4.2 to address these issues. Please see the references for more information.
Solution:
The vendor released UCP 4.2 to address these issues. Please see the references for more information.
References
Cisco User-Changeable Password (UCP) 'CSuserCGI.exe' Multiple Remote Vulnerabilities
References:
References:
- Installation and User Guide for Cisco Secure ACS User Changeable Passwords (Cisco)
- Cisco ACS UCP Remote Pre-Authentication Buffer Overflows ("Felix 'FX' Lindner"
- Cisco Security Advisory: Cisco Secure Access Control Server for Windows User-Cha (Cisco Systems Product Security Incident Response Team
- Cisco Secure Access Control Server for Windows User-Changeable Password Vulnerab (Cisco)