Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Vulnerability
BID:35475
Info
Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Vulnerability
| Bugtraq ID: | 35475 |
| Class: | Design Error |
| CVE: |
CVE-2009-1203 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 24 2009 12:00AM |
| Updated: | Jun 26 2009 01:49PM |
| Credit: | David Byrne of Trustwave's SpiderLabs |
| Vulnerable: |
Cisco Adaptive Security Appliance 8.2.1 Cisco Adaptive Security Appliance 8.1.2 Cisco Adaptive Security Appliance 8.0.2 11 Cisco Adaptive Security Appliance 8.1(2)19 Cisco Adaptive Security Appliance 8.1 (2)14 Cisco Adaptive Security Appliance 8.0(4) |
| Not Vulnerable: |
Cisco Adaptive Security Appliance 8.2.1 3 Cisco Adaptive Security Appliance 8.1.2.25 Cisco Adaptive Security Appliance 8.0.4.34 |
Discussion
Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Vulnerability
Cisco Adaptive Security Appliance (ASA) is prone to a vulnerability that can aid in phishing attacks.
An attacker can exploit this issue to display a fake login window that's visually similar to the device's login window, which may mislead users.
This issue is tracked by Cisco Bug ID CSCsy80709.
The attacker can exploit this issue to set up phishing attacks. Successful exploits could aid in further attacks.
Versions prior to ASA 8.0.4.34 and 8.1.2.25 are vulnerable.
Cisco Adaptive Security Appliance (ASA) is prone to a vulnerability that can aid in phishing attacks.
An attacker can exploit this issue to display a fake login window that's visually similar to the device's login window, which may mislead users.
This issue is tracked by Cisco Bug ID CSCsy80709.
The attacker can exploit this issue to set up phishing attacks. Successful exploits could aid in further attacks.
Versions prior to ASA 8.0.4.34 and 8.1.2.25 are vulnerable.
Exploit / POC
Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Vulnerability
Attackers can exploit this issue by tricking an unsuspecting victim into following a malicious URI.
The following example is available:
/+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F7367632e726b6e7a6379722e70627a
Attackers can exploit this issue by tricking an unsuspecting victim into following a malicious URI.
The following example is available:
/+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F7367632e726b6e7a6379722e70627a
Solution / Fix
Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Vulnerability
Solution:
Updates are reported to be available. Please see the references for details.
Solution:
Updates are reported to be available. Please see the references for details.
References
Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Vulnerability
References:
References:
- Cisco Adaptive Security Appliance Homepage (Cisco)
- Cisco ASA Adaptive Security Appliance Clientless SSL VPN CIFS and FTP Credential (Cisco)
- Cisco ASA Web VPN Multiple Vulnerabilities (Trustwave's SpiderLabs)
- Trustwave's SpiderLabs Security Advisory TWSL2009-002 (Trustwave Advisories