Cisco IronPort Encryption Appliance and PostX Multiple Remote Vulnerabilities

Bugtraq ID:	33268
Class:	Unknown
CVE:	CVE-2009-0053 CVE-2009-0054 CVE-2009-0055 CVE-2009-0056
Remote:	Yes
Local:	No
Published:	Jan 14 2009 12:00AM
Updated:	Jan 14 2009 08:12PM
Credit:	J.B. Snyder of Brintech and the vendor.
Vulnerable:	Cisco IronPort PostX 6.2.2 Cisco IronPort PostX 6.2.1 Cisco IronPort Encryption Appliance 6.2.7 Cisco IronPort Encryption Appliance 6.2.6 Cisco IronPort Encryption Appliance 6.2.5 Cisco IronPort Encryption Appliance 6.2.4 Cisco IronPort Encryption Appliance 6.5 Cisco IronPort Encryption Appliance 6.3
Not Vulnerable:	Cisco IronPort PostX 6.2.2 3 Cisco IronPort PostX 6.2.1 1 Cisco IronPort Encryption Appliance 6.5 2 Cisco IronPort Encryption Appliance 6.3 4 Cisco IronPort Encryption Appliance 6.2.7 7 Cisco IronPort Encryption Appliance 6.2.4 1

Cisco IronPort Encryption Appliance and PostX Multiple Remote Vulnerabilities

Cisco IronPort Encryption Appliance and PostX are prone to multiple information-disclosure and cross-site request-forgery vulnerabilities.

Attackers may exploit these issues to obtain sensitive information, including user passwords, or to modify user information through the web administration interface. This may aid in further attacks.

Cisco IronPort Encryption Appliance and PostX Multiple Remote Vulnerabilities

For some of these issues, an attacker can use commonly available tools. To exploit a cross-site request-forgery issue, the attacker must entice a user into following a maliciously constructed link.

Cisco IronPort Encryption Appliance and PostX Multiple Remote Vulnerabilities

Solution:
Vendor updates are available; please see the references for more information.

Cisco IronPort Encryption Appliance and PostX Multiple Remote Vulnerabilities

References:

• Cisco Homepage (Cisco)
  
• IronPort Encryption Appliance Homepage (IronPort)
  
• Cisco Security Advisory: IronPort Encryption Appliance / PostX and PXE Encryptio (Cisco)